{"cvss":0.0,"datePublished":"2026-08-28T00:00:00Z","dateUpdated":"2026-08-28T00:00:00Z","description":"The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.","dueDate":"","id":"CVE-2026-16759","kev_catalogs":["vulncheck"],"knownRansomwareCampaignUse":"Unknown","product":"tutor_lms","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","severity":"HIGH","source":"vulncheck_kev","title":"Themeum tutor_lms Improper Neutralization of Special Elements in Output Used by a Downstream Component","vendor":"Themeum"}