CVE-2026-16759: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in themeum Tutor LMS – eLearning and online course solution

CVE-2026-16759 is an injection vulnerability (CWE-74) in the Tutor LMS WordPress plugin (up to 4.0.5) that permits unauthenticated remote code execution limited to zero-argument PHP function calls. The vulnerability arises from missing authorization on the tutor_course_filter_ajax AJAX handler and unsanitized array keys passed to extract() within tutor_load_template(). This allows attacker-controlled POST data to overwrite the $template variable, leading to invocation of arbitrary zero-argument functions via $method_map[$context](). Additionally, attackers can leverage WordPress core edit_user() to create persistent subscriber-level accounts from request parameters.

An unauthenticated attacker can remotely execute arbitrary zero-argument PHP functions on the server hosting the vulnerable Tutor LMS plugin, potentially leading to unauthorized actions. The attacker can also create persistent subscriber-level WordPress accounts, which may facilitate further attacks or unauthorized access. The CVSS score is 6.5 (medium severity), indicating a moderate impact with no requirement for privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable AJAX action if possible and monitor for suspicious activity related to unauthorized account creation. Avoid exposing the Tutor LMS plugin to untrusted networks.