The Tutor LMS plugin for WordPress is vulnerable to a critical PHP object injection flaw that permits remote code execution, necessitating an immediate update to version 4.0.8.

This vulnerability is a PHP Object Injection flaw (CWE-502) residing in the tutor_save_withdraw_account AJAX handler. The handler lacks proper capability checks, allowing an authenticated attacker with subscriber-level access to inject arbitrary serialized objects, which can be leveraged to achieve remote code execution via a POP chain.

Successful exploitation allows an attacker to execute arbitrary code on the underlying web server, leading to a full compromise of the WordPress site. Given the CVSS score of 8.8, this vulnerability poses a high risk, as it enables unauthorized data access, potential modification of course content, and total system control. The impact is compounded by the fact that the vulnerability is reachable by any registered user if the monetization feature is enabled.

Immediate Action: Update the Tutor LMS plugin to version 4.0.8 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Review web server access logs for suspicious POST requests directed at the tutor_save_withdraw_account AJAX endpoint. Monitor administrative user accounts for unauthorized modifications or unexpected privilege escalation.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block malicious serialized objects in POST requests. If patching is not immediately feasible, disable the monetization and user registration features to reduce the attack surface.

Public Exploit Available: Unknown

The severity of this vulnerability, combined with the potential for remote code execution, requires immediate attention from all administrators utilizing the Tutor LMS plugin. Ensure that all plugins are updated to the latest vendor-provided versions to mitigate the risk of compromise. Failure to patch this vulnerability leaves the server exposed to full administrative takeover by any registered user account.