cve-2026-16759

{
  "cvss": 0.0,
  "datePublished": "2026-08-28T00:00:00Z",
  "dateUpdated": "2026-08-28T00:00:00Z",
  "description": "The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Remote Code Execution limited to zero-argument function invocation in all versions up to, and including, 4.0.5 via the tutor_course_filter_ajax AJAX action. This is due to missing authorization on the handler combined with unsanitized array keys being passed to extract() inside tutor_load_template(), allowing attacker-controlled POST data to overwrite the local $template variable and, in the resulting templates/single-content-loader.php template, the $method_map and $context variables invoked at $method_map[$context](). This makes it possible for unauthenticated attackers to call an arbitrary zero-argument PHP function server-side and, via WordPress core edit_user(), to create a persistent subscriber-level account from request parameters.",
  "dueDate": "",
  "id": "CVE-2026-16759",
  "kev_catalogs": [
    "vulncheck"
  ],
  "knownRansomwareCampaignUse": "Unknown",
  "product": "tutor_lms",
  "requiredAction": "Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.",
  "severity": "HIGH",
  "source": "vulncheck_kev",
  "title": "Themeum tutor_lms Improper Neutralization of Special Elements in Output Used by a Downstream Component",
  "vendor": "Themeum"
}