TutorStarter Theme CVE-2026-104671

Exploitation requires that the target site runs the TutorStarter WordPress theme at a version before 4.0.4 and that it exposes the specific vulnerable AJAX registration handler (reachable via wp-admin/admin-ajax.php). The notable condition is that the flaw manifests precisely because the handler does NOT honor the site's 'Anyone can register' (users_can_register) setting - so it is exploitable even on sites that have DISABLED registration, which is the configuration administrators would otherwise rely on as a defense. Limiting factors: impact is confined to creating accounts at WordPress's default registration role (typically low-privilege subscriber), there is no authentication bypass to higher roles and no confidentiality or availability impact; exploitation is only possible while the vulnerable theme version is active.

This is a low-to-moderate priority issue despite the 'network/unauthenticated' profile. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N = 5.3 Medium) is internally consistent with the description: a remote, unauthenticated visitor can reach an AJAX endpoint with low complexity, no privileges, and no user interaction, but the only impact is Integrity-Low (unauthorized creation of low-privilege WordPress accounts) with no confidentiality or availability impact. Public exploit code exists (WPScan), which raises practical exploitability, but there is NO CISA KEV listing and NO EPSS score was provided, so active or widespread exploitation cannot be asserted - POC availability is a distinct, weaker signal than confirmed exploitation. The real-world risk is bounded by the fact that the created accounts default to WordPress's lowest role (typically 'subscriber') on most installs, making this primarily a bypass of an administrator's intent (registration disabled) and a potential foothold/spam vector rather than a direct compromise. No key signals are conflicting; the main gap is the absence of EPSS/KEV data, so prioritization should rely on deployment footprint rather than threat-intel urgency.

An attacker targets a WordPress site running the TutorStarter theme (below 4.0.4) whose administrator has deliberately disabled public user registration. The attacker sends a crafted request directly to the vulnerable AJAX registration handler, which fails to check the site's registration setting and creates a new user account. A public POC/exploit is available via WPScan, lowering the effort required; the attacker can then script bulk account creation for spam, abuse of member-only features, or as a staging foothold.