CVE-2026-16759: Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutorcoursefilterajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutorloadtemplate(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $methodmap and $context variables invoked at $methodmap$context. This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edituser(), to create a persistent subscriber-level account from request parameters.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit the affected AJAX action. No existing WordPress or Tutor LMS account is required.
What is the practical impact of exploitation?
An attacker can invoke arbitrary zero-argument PHP functions on the server. The described impact includes using WordPress core edit_user() with request parameters to create a persistent subscriber-level account.
Which deployments are affected?
Tutor LMS versions up to and including 4.0.5 are affected. The vulnerable path is the tutor_course_filter_ajax AJAX action and does not require authorization.
What conditions are required for exploitation?
The attacker needs network access to reach the WordPress site and submit POST parameters to the vulnerable AJAX action. The supplied data identifies no requirement for user interaction, credentials, or a complex attack setup.