CVE-2026-16759
Received Received - Intake

Remote Code Execution in Tutor LMS WordPress Plugin

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: Wordfence

Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-28
Last Modified
2026-08-28
Generated
2026-09-17
AI Q&A
2026-08-28
EPSS Evaluated
2026-09-15
NVD
CVE-2026-16759
EUVD
EUVD-2026-67406

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tutor_lms tutor_lms to 4.0.5 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Tutor LMS WordPress plugin allows unauthenticated attackers to execute remote code by exploiting missing authorization checks and unsanitized input. Attackers can overwrite variables in a template file to call arbitrary PHP functions, including creating a subscriber account via WordPress core functions.

Detection Guidance

Check for unauthorized user creation in WordPress admin panels or unusual AJAX requests to the tutor_course_filter_ajax endpoint. Monitor server logs for unexpected PHP function calls or template file accesses.

Impact Analysis

If exploited, attackers could gain control over your WordPress site, create unauthorized user accounts, or execute malicious code. This could lead to data theft, site defacement, or further compromise of your server or network.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Update the Tutor LMS plugin to the latest version immediately. Disable the tutor_course_filter_ajax action if not needed. Review WordPress user accounts for unauthorized subscribers and remove any suspicious ones.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16759. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart