Remote Code Execution Vulnerability in Tutor LMS Plugin for WordPress

CVE-2026-16759

What is CVE-2026-16759?

The Tutor LMS plugin for WordPress, an eLearning and online course solution, is susceptible to a Remote Code Execution vulnerability that arises from a lack of proper authorization and insufficient sanitization of input data. This issue, present in all versions up to and including 4.0.5, allows unauthenticated attackers to exploit the AJAX action 'tutor_course_filter_ajax'. By manipulating POST data, attackers can overwrite critical variables within the plugin’s templates, enabling them to invoke arbitrary zero-argument PHP functions on the server. This vulnerability also allows attackers to exploit the WordPress core function 'edit_user()', leading to the potential creation of unauthorized subscriber-level accounts. Site owners are encouraged to update to the latest version to mitigate this risk.

References