Slopothecary

**Name of the Vulnerable Software and Affected Versions** Tutor LMS versions prior to 4.0.6 **Description** Tutor LMS is subject to remote code execution limited to zero-argument function invocation. The issue occurs via the `tutor course filter ajax` AJAX action due to missing authorization on the handler and the use of the `extract()` function within `tutor load template()` with unsanitized array keys. This allows an unauthenticated attacker to overwrite the local `$template` variable, which subsequently influences the `$method map` and `$context` variables invoked at `$method map[$context]()` within the `templates/single-content-loader.php` template. Consequently, an attacker can call arbitrary zero-argument PHP functions server-side. This can be abused via the WordPress core `edit user()` function to create a persistent subscriber-level account using request parameters. **Recommendations** Update Tutor LMS to version 4.0.6 or later. As a temporary mitigation, restrict access to the `tutor course filter ajax` AJAX action.