Tutorstarter
Monthly
Unauthenticated account creation in the TutorStarter WordPress theme (all versions before 4.0.4) allows any remote visitor to create a WordPress user account through the theme's AJAX registration handler even when the site has disabled user registration. The flaw bypasses the users_can_register setting administrators rely on as a safety control, but created accounts receive WordPress's default registration role, typically a low-privilege Subscriber, with no confidentiality or availability impact (CVSS 5.3, PR:N per the assessed vector). Publicly available exploit code exists and the WPScan advisory documents the vector, but there is no confirmed active exploitation (not in CISA KEV); exposure lasts only while an affected theme version is active. This is a low-to-moderate priority issue despite its network/unauthenticated profile.
Unauthenticated account creation in the TutorStarter WordPress theme (all versions before 4.0.4) allows any remote visitor to create a WordPress user account through the theme's AJAX registration handler even when the site has disabled user registration. The flaw bypasses the users_can_register setting administrators rely on as a safety control, but created accounts receive WordPress's default registration role, typically a low-privilege Subscriber, with no confidentiality or availability impact (CVSS 5.3, PR:N per the assessed vector). Publicly available exploit code exists and the WPScan advisory documents the vector, but there is no confirmed active exploitation (not in CISA KEV); exposure lasts only while an affected theme version is active. This is a low-to-moderate priority issue despite its network/unauthenticated profile.