CVE-2026-16759
published 2026-08-28CVE-2026-16759: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation…
PriorityP181medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
ITWVulnCheck KEV
Exploited in the wild
EPSS
0.62%
47.6th percentile
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| themeum | tutor_lms_elearning_and_online_course_solution | <= 4.0.5 | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
vulncheck6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.
ghsa_unreviewed·2026-08-28
CVE-2026-16759 [MEDIUM] CWE-74 The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber
VulDB
meum Tutor LMS Plugin up to 4.0.5 on WordPress Tutor Course Filter AJAX single-content-loader.php tutor_load_template improper authorization (EUVD-2026-67406)
vuldb·2026-08-28·CVSS 6.5
CVE-2026-16759 [MEDIUM] meum Tutor LMS Plugin up to 4.0.5 on WordPress Tutor Course Filter AJAX single-content-loader.php tutor_load_template improper authorization (EUVD-2026-67406)
A vulnerability categorized as critical has been discovered in meum Tutor LMS Plugin up to 4.0.5 on WordPress. This issue affects the function tutor_load_template of the file templates/single-content-loader.php of the component Tutor Course Filter AJAX. Such manipulation leads to improper authorization.
This vulnerability is listed as CVE-2026-16759. The attack may be performed from remote. There is no available exploit.
VulnCheck
themeum tutor_lms Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
vulncheck·2026·CVSS 6.5
CVE-2026-16759 [MEDIUM] themeum tutor_lms Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
themeum tutor_lms Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an a
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/classes/Course_Filter.php#L224https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/classes/Course_Filter.php#L58https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/includes/tutor-template-functions.php#L118https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/includes/tutor-template-functions.php#L128https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/templates/single-content-loader.php#L30https://plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/templates/single-content-loader.php#L71https://plugins.trac.wordpress.org/changeset/3653079/tutor/trunk/templates/single-content-loader.phphttps://plugins.trac.wordpress.org/changeset?old_path=%2Ftutor/tags/4.0.5&new_path=%2Ftutor/tags/4.0.6https://www.wordfence.com/threat-intel/vulnerabilities/id/65f68a49-8ded-479f-a9c3-187703bfae65?source=cve
2026-08-28
Published
Exploited in the wild