A critical injection vulnerability in the Tutor LMS WordPress plugin enables unauthenticated attackers to execute arbitrary PHP functions, posing a severe risk of full site compromise.

The vulnerability stems from improper neutralization of request data during template rendering, which allows the overwriting of internal variables. An unauthenticated attacker can leverage this flaw to invoke arbitrary zero-argument PHP functions and retrieve sensitive data or manipulate system execution.

Successful exploitation of this vulnerability grants an attacker the ability to execute arbitrary code within the context of the web server. This could lead to the theft of sensitive educational data, complete takeover of the WordPress installation, or the deployment of persistent backdoors. Given the CVSS score of 9.8, this flaw represents a critical threat to organizational integrity and data confidentiality.

Immediate Action: Update the Tutor LMS WordPress plugin to version 4.0.6 or later immediately to apply the vendor-supplied security patch.

Proactive Monitoring: Review web server access logs for anomalous requests targeting template rendering endpoints, specifically looking for unusual patterns or unexpected function calls.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious input patterns and suspicious PHP function calls that may be indicative of injection attempts.

Public Exploit Available: Unknown (exploit_available: false)

The critical nature of this vulnerability cannot be overstated, as it permits unauthenticated remote code execution. Security teams must prioritize the update of the Tutor LMS plugin across all environments to prevent unauthorized access and potential data exfiltration. Immediate patching is the only effective way to neutralize this risk.