CVE-2026-16759: CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in themeum Tutor LMS – eLearning and online course solution

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to remote code execution in all versions up to and including 4.0.5. The vulnerability arises from missing authorization on the tutor_course_filter_ajax AJAX handler combined with unsanitized array keys passed to the PHP extract() function inside tutor_load_template(). This allows attacker-controlled POST data to overwrite the local $template variable, leading to the invocation of arbitrary zero-argument PHP functions via $method_map[$context](). Furthermore, attackers can leverage WordPress core's edit_user() function to create persistent subscriber-level accounts from request parameters without authentication.

An unauthenticated attacker can execute arbitrary zero-argument PHP functions on the server, potentially leading to unauthorized actions within the WordPress environment. They can also create persistent subscriber-level user accounts, which may facilitate further attacks or unauthorized access. The vulnerability impacts confidentiality and integrity but does not directly affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the vulnerable AJAX action if possible and monitor for suspicious activity related to user account creation. Avoid exposing the tutor_course_filter_ajax endpoint to untrusted users.