Tutor LMS CVE-2026-16759

Exploitation requires: (1) the Tutor LMS plugin installed and active at version 4.0.5 or earlier; (2) the WordPress AJAX endpoint wp-admin/admin-ajax.php reachable over the network - true by default for any internet-facing WordPress site; (3) the tutor_course_filter_ajax action registered, which occurs automatically on plugin activation with no additional configuration. No authentication, elevated privileges, special non-default configuration, or prior account is required. The key limiting factor is the zero-argument function invocation constraint - only PHP callables that accept zero arguments or read from superglobals (such as $_POST) can be invoked, preventing direct OS command execution via functions like system() or exec(). Account creation via edit_user() is limited to subscriber-level, not administrator privilege, so direct site takeover in a single step is not possible without chaining to additional vulnerabilities.

The NVD CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) accurately reflects the unauthenticated, network-accessible, zero-complexity attack surface but arguably understates real-world integrity impact given persistent account creation capability. The zero-argument invocation constraint is the primary severity limiter - functions like system(), exec(), and shell_exec() require arguments and cannot be directly invoked, preventing straightforward OS command execution. However, the edit_user() pathway effectively bypasses this constraint by reading attacker-controlled POST data, which is a material finding beyond what the CVSS score communicates. EPSS data was not provided in the available intelligence; risk from that signal cannot be assessed. There is no CISA KEV listing, and no explicit POC code was identified, but Wordfence's disclosure with specific file paths and line numbers in the WordPress plugin repository constitutes near-POC technical detail. The attack requires no special configuration beyond the plugin being active, and WordPress AJAX endpoints are exposed by default on all internet-facing installations. This represents a real, immediate priority for any site running Tutor LMS 4.0.5 or earlier, with a clear patch path to 4.0.6.

An unauthenticated attacker sends a crafted POST request to the WordPress AJAX endpoint (wp-admin/admin-ajax.php) with the action parameter set to tutor_course_filter_ajax, including POST body keys engineered to overwrite the $method_map and $context variables in the template scope via extract(). With those variables under attacker control, the template's $method_map[$context]() call is redirected to WordPress's edit_user() function, which reads account creation fields directly from the attacker's POST data, resulting in a persistent subscriber-level account being registered on the target site with no prior authentication required. The attack is fully automatable and scriptable against any network-reachable WordPress installation running Tutor LMS 4.0.5 or earlier.