CVE-2026-16759

Name of the Vulnerable Software and Affected Versions Tutor LMS versions prior to 4.0.6

Description Tutor LMS is subject to remote code execution limited to zero-argument function invocation. The issue occurs via the tutor course filter ajax AJAX action due to missing authorization on the handler and the use of the extract() function within tutor load template() with unsanitized array keys. This allows an unauthenticated attacker to overwrite the local $template variable, which subsequently influences the $method map and $context variables invoked at $method map[$context]() within the templates/single-content-loader.php template. Consequently, an attacker can call arbitrary zero-argument PHP functions server-side. This can be abused via the WordPress core edit user() function to create a persistent subscriber-level account using request parameters.

Recommendations Update Tutor LMS to version 4.0.6 or later. As a temporary mitigation, restrict access to the tutor course filter ajax AJAX action.