Description
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.
References9
- plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/classes/Cou…
- plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/classes/Cou…
- plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/includes/tu…
- plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/includes/tu…
- plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/templates/s…
- plugins.trac.wordpress.org/browser/tutor/tags/4.0.1/templates/s…
- plugins.trac.wordpress.org/changeset/3653079/tutor/trunk/templa…
- plugins.trac.wordpress.org/changeset?old_path=%2Ftutor/tags/4.0…
- www.wordfence.com/threat-intel/vulnerabilities/id/65f68a49-8ded…
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N - EPSS — exploit probability
- 1% percentile: 55 · as of 8 November 2026
- CWE
- CWE-74
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.