Executive brief
Tutor LMS is a popular WordPress plugin for creating and managing online courses. The plugin contains a vulnerability that allows unauthenticated attackers to execute arbitrary PHP functions on the server, potentially creating unauthorized admin or subscriber accounts and compromising course data or student information. This vulnerability affects all versions up to 4.0.5 and requires only a single malicious web request to exploit.
Technical details
The vulnerability is a Remote Code Execution flaw caused by missing authorization checks and improper input sanitization in the tutor_course_filter_ajax AJAX handler. Attackers send crafted POST requests to the AJAX action that pass unsanitized array keys to the extract() function within tutor_load_template(), allowing them to overwrite local variables including $template, $method_map, and $context. These variables are then invoked in templates/single-content-loader.php as $method_map[$context](), enabling arbitrary zero-argument PHP function calls. By exploiting WordPress's built-in edit_user() function, attackers can create persistent subscriber-level accounts without authentication. The attack requires network access to a WordPress installation running the vulnerable plugin.
Affected products
- Tutor LMS Tutor LMS up to and including 4.0.5
Timeline
- 2026-08-28: disclosed