Tutor LMS: PHP Object Injection leads to RCE, over 100,000 sites at risk

Wordfence Argus has discovered a PHP Object Injection vulnerability in the Tutor LMS plugin for WordPress, which is used to create online courses and e-learning areas on WordPress sites. The bug, reported by Wordfence on 17 September 2026, affects more than 100,000 active installations and allows, according to the vendor's advisory, remote code execution from an account with just the basic subscriber role.

For those managing shared hosting or VPS with multiple client WordPress sites, the key takeaway is this: you don't need administrator credentials to exploit the flaw. A registered user with minimal privileges will suffice—the kind of account that any site with open registration grants by default. From there, through object injection, an attacker can execute code on the server hosting the site.

What to do

Wordfence recommends updating Tutor LMS to version 4.0.8 as soon as possible. The update is available from the WordPress.org plugin repository and from the admin panel of affected sites.

For those administering multiple WordPress installations on behalf of clients, the practical checklist is:

• verify which sites in your infrastructure have Tutor LMS active (including as a dependency of a theme or another plugin);
• check the installed version from Plugins > Installed Plugins, or from the command line with wp plugin list --name=tutor if you use WP-CLI;
• force the update to 4.0.8 on sites lagging behind, including those with automatic updates disabled by internal policy;
• for those running WAF at panel or CDN level, check whether your security solution provider has already released a specific rule for this CVE, whilst you wait for all sites to be updated.

Object injection remains one of the most insidious classes of vulnerability in WordPress plugins because it often doesn't require elevated privileges to be triggered—just an entry point that deserialises untrusted data. For providers hosting sites with open public registrations, such as online courses or communities, the exposure level is above average.

The full advisory, with technical details of the vulnerability, is published on the Wordfence blog.