Moodle 4.3 End of Life: Security Patches Now Available with HeroDevs NES

Moodle 4.3 reached end of life and stopped receiving upstream security fixes on April 21, 2025. Since then, Moodle has published at least 13 security advisories that affect version 4.3 with no official 4.3 patch, including five the Moodle security team rates Serious: two remote code execution flaws, a command injection, a SQL injection, and a cross-site scripting vulnerability.

Today HeroDevs is closing that gap. Never-Ending Support (NES) for Moodle 4.3 delivers ongoing, SLA-backed security patches for organizations still running Moodle 4.3, starting with backports for every known post-EOL vulnerability. For teams running IOMAD, NES for IOMAD 4.3 extends the same coverage to the multi-tenant Moodle distribution used for corporate and multi-organization training.

If you manage a Moodle 4.3 site, here is what you are exposed to, why the upgrade is harder than it looks, and what NES covers.

What Vulnerabilities Affect Moodle 4.3 After End of Life?

Moodle's support policy is predictable: major versions every six months, security fixes for 18 months on standard releases and 36 months on long-term support (LTS) releases. Moodle 4.3 shipped in October 2023, received its final security release (4.3.12) in April 2025, and then aged out. Every vulnerability disclosed since is fixed only in 4.4 and later.

As of September 2026, the post-End-of-Life (EOL) backlog for 4.3 includes these Serious-rated issues:

Twenty-seven further Minor-rated advisories (CSRF, stored XSS, information disclosure, and denial of service issues) also affect 4.3 with no upstream fix. The full mapping, advisory by advisory, is published in the Moodle security announcements feed at moodle.org/security.

These are not theoretical. Moodle vulnerabilities get weaponized: CVE-2024-43425, a remote code execution flaw affecting 4.3.0 through 4.3.5, has had a public Metasploit module since late 2024. The window between a Moodle disclosure and a working exploit is measured in weeks. A 4.3 site today has no patch coming for any of the 13 issues above, and the list grows with each of Moodle's roughly bi-monthly advisory batches.

For organizations under frameworks and regulations such as SOC 2, GDPR, NIS2, the EU Cyber Resilience Act, it is also an audit problem, not just a security one. Software receiving no security maintenance fails common vulnerability-management controls regardless of whether any single CVE has been exploited against you.

Why So Many Sites Are Still on Moodle 4.3

Moodle major upgrades are mechanically simple (replace the code tree and run the database upgrade) but operationally expensive, because the real surface is everything around core:

• Plugins. A typical deployment runs 20 to 80 third-party plugins, each declaring its own supported version range. Moving from 4.3 to the 4.5 LTS requires every one of them to ship a compatible release, be replaced, or be forked and maintained in-house.
• Themes and custom code. Custom themes built on Moodle 4.3's Bootstrap 4 base need rework for later versions, and deprecated core APIs (output renderers and gradebook internals in particular) break custom code paths.
• The platform underneath. Moodle 4.3 runs on PHP 8.0 to 8.2; 4.5 requires PHP 8.1 to 8.3 and current 5.x releases require PHP 8.2 to 8.4. For many organizations that means OS or hosting changes in the same project.
• The calendar. Education institutions and universities upgrade between terms. Compliance-training operators upgrade between recertification cycles. If the window is missed, the next one is months away.

For a heavily customized deployment, a 4.3 to 4.5 move is a project measured in months, not a maintenance window. That is the gap NES exists to cover: not a substitute for eventually upgrading, but security coverage for the time the upgrade actually takes.

What NES for Moodle 4.3 Includes

NES for Moodle 4.3 follows the same model HeroDevs uses across its Never-Ending Support product line: fork the final upstream release, backport security fixes, and deliver a validated and secure drop-in replacement.

• Baseline: Moodle 4.3.12. The fork starts at the last official 4.3 security release, so every fix upstream ever shipped to 4.3 is already inherited, including CVE-2025-3641 (CVSS 8.8, an authenticated RCE via the Dropbox repository fixed in 4.3.12 itself).
• Backport-only. NES releases contain security fixes. No new features, no behavior changes. Your existing database schema, plugins, themes, and integrations continue to work exactly as they do today.
• Every applicable advisory. Each Moodle Security Announcement that affects 4.3 is backported, tested against the 4.3 baseline, and shipped with release notes mapping each fix to its CVE identifier, evidence you can hand directly to an auditor. Fixed CVEs are listed in the HeroDevs vulnerability directory.
• Standard delivery. Releases ship as a versioned archive in standard Moodle layout through HeroDevs secure registry.

NES for IOMAD 4.3: Multi-Tenant Moodle Is Covered Too

IOMAD is the multi-tenant Moodle distribution, widely used by training providers, franchise operations, and corporate L&D teams that serve many client organizations from one platform. Because IOMAD is built directly on Moodle core, every Moodle core vulnerability above flows through to IOMAD 4.3.

The stakes are also higher. A single IOMAD instance often hosts dozens of tenant organizations, so one unpatched remote code execution vulnerability has a multi-tenant blast radius: one compromise, many affected customers.

NES for IOMAD 4.3 takes each Moodle 4.3 backport, reconciles it against IOMAD's core modifications, and revalidates multi-tenancy behavior before release. IOMAD subscribers get the same delivery channel and the same CVE-mapped release notes, and the same drop-in compatibility with an existing IOMAD 4.3 deployment.

Your Options for Moodle 4.3

1. Upgrade now. Moodle 4.5 is the current LTS version, with security support until October 2027, and 5.x releases are available for teams that want the latest features. If your plugin set is compatible and you have the window, this is the right long-term move.

2. HeroDevs NES. Keep running 4.3 exactly as deployed, receive tested vulnerability fixes with SLA commitments, and schedule the upgrade in the future on your own timetable.

Most NES customers use option two to buy time for option one on their own terms. That is the intended use.

Next Steps for Moodle 4.3 and IOMAD 4.3 Sites

If you are running Moodle 4.3 or IOMAD 4.3, the exposure is already live and growing with every upstream advisory cycle. Talk to HeroDevs about NES for Moodle and IOMAD to get patched against the current backlog and stay covered until your upgrade lands.

Frequently Asked Questions

Is Moodle 4.3 still supported?

No. Moodle 4.3 reached security end of life on April 21, 2025. Its final release was 4.3.12, and all subsequent security fixes have shipped only in Moodle 4.4 and later. HeroDevs NES for Moodle 4.3 provides continued security patches beyond that date.

Does NES for Moodle 4.3 change my site or plugins?

No. NES is backport-only: security fixes applied to the 4.3.12 baseline with no feature changes and no behavior changes. It is drop-in compatible with an existing 4.3 installation, including its database schema, plugins, and themes, and installs like a normal Moodle point upgrade.

Does NES cover IOMAD?

Yes. NES for IOMAD 4.3 covers the multi-tenant IOMAD distribution built on Moodle 4.3, with each Moodle core backport reconciled against IOMAD's modifications and revalidated for multi-tenancy behavior.

What about Moodle 4.1 and 4.4? They are EOL too.

Moodle 4.1 LTS and 4.4 both reached end of life on December 8, 2025. NES coverage launches with Moodle 4.3 and IOMAD 4.3; if you are running another EOL Moodle version, contact HeroDevs to discuss coverage.