100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS

Élevé · Wordfence · 17 septembre 2026

WordPress

Ce qui s'est passé

PHP object injection flaw in the Tutor LMS WordPress plugin lets subscriber-level accounts achieve remote code execution; over 100,000 sites affected. Fixed in version 4.0.8.

À faire maintenant

Update Tutor LMS to 4.0.8 now; if you cannot patch immediately, deactivate the plugin. Then restrict open subscriber registration, audit new/low-privilege accounts, review logs, and scan for webshells.

Source originale

Wordfence

Analyse assistée par IA, sources citées. Vérifiez auprès de l'avis du fournisseur avant d'agir.