CVE-2026-16759Disclosure

🚨 WORDPRESS SECURITY — TUTOR LMS HIT BY NEW UNAUTHENTICATED SERVER-SIDE CODE-EXECUTION FLAW CVE-2026-16759 lets a remote attacker invoke attacker-selected zero-argument PHP functions without authentication — and can be abused to create a persistent WordPress account. CyberSignal Priority: 🔴 VERY HIGH CVE-2026-16759 📅 August 28, 2026 🏷️ WordPress · RCE · Authentication Bypass · Web Security · LMS 🛠️ Product: Tutor LMS 🏢 Vendor: Themeum A newly published vulnerability affects Tutor LMS, the WordPress learning-management plugin. The key combination is concerning: 🌐 Network reachable ↓ 🔓 No authentication required ↓ 👤 No user interaction ↓ ⚙️ Server-side PHP function invocation. ### 🔎 What happened According to the CVE record assigned through Wordfence, Tutor LMS versions through: 4.0.5 contain a vulnerability in the: `tutor_course_filter_ajax` AJAX action. The handler lacks sufficient authorization checks. At the same time, attacker-controlled array keys can reach PHP's: `extract()` function. That creates a variable-overwrite condition. Attackers can manipulate local variables including: `$template` and subsequently influence: `$method_map` + `$context` which are eventually used in a dynamic function call. The result: an unauthenticated attacker can cause the server to invoke attacker-selected: ZERO-ARGUMENT PHP FUNCTIONS. ### ⚔️ Attack chain Remote unauthenticated attacker ↓ Crafted POST request ↓ `tutor_course_filter_ajax` ↓ Missing authorization ↓ Attacker-controlled array keys ↓ `extract()` variable overwrite ↓ Template/control variables manipulated ↓ Attacker-selected PHP function invoked ↓ Potential persistent WordPress account creation One particularly important abuse path involves the WordPress core: `edit_user()` function. According to the vulnerability description, an attacker can use request parameters to create a: PERSISTENT SUBSCRIBER-LEVEL ACCOUNT. That gives the attacker a foothold that survives beyond the initial request. ### 🎯 What is affected Tutor LMS: ≤ 4.0.5 The vulnerability was fixed beginning with: 4.0.6. The current http://WordPress.org changelog also shows: 4.0.7 is already available. Administrators should therefore move to the newest supported version rather than remaining anywhere at or below 4.0.5. ### 🧠 Why this matters This vulnerability demonstrates why PHP variable-overwrite bugs can become dangerous. The attacker does not necessarily need a traditional command-injection primitive such as: `system("malicious command")` Instead: user-controlled input ↓ modifies application state ↓ changes which function executes ↓ turns legitimate application logic against itself. That can be enough to create persistence or manipulate server-side behavior. And because Tutor LMS operates inside WordPress, compromise can potentially become a stepping stone toward: account abuse ↓ plugin/theme manipulation ↓ credential theft ↓ further privilege escalation ↓ website compromise. The exact post-exploitation possibilities depend on the site's configuration and other available vulnerabilities. ### ⚠️ Important caveat There is a VERY important technical distinction here. Although the CVE description categorizes the issue as: REMOTE CODE EXECUTION, this is NOT equivalent to unrestricted: `bash` `cmd` `powershell` command execution. The primitive is specifically described as: ARBITRARY ZERO-ARGUMENT PHP FUNCTION INVOCATION. That is more constrained than a fully attacker-controlled shell. Wordfence's primary CVSS assessment is: 6.5 / 10 — MEDIUM. So CyberSignal should NOT falsely present this as a CVSS 9.8 unauthenticated shell-RCE vulnerability. There is also currently no confirmed evidence reviewed by CyberSignal showing widespread active exploitation in the wild. ### 🛡️ Defender action Tutor LMS administrators should: → upgrade immediately to 4.0.6+ → preferably deploy the latest 4.0.7 release → inspect newly created WordPress users → review unexpected subscriber accounts → inspect AJAX requests to `tutor_course_filter_ajax` → review administrative activity → check recently modified plugins/themes → rotate credentials if compromise is suspected. Pay particular attention to accounts created unexpectedly before the upgrade. CyberSignal Insight: **RCE does not always begin with a shell — sometimes the attacker wins by convincing your application to execute its own functions in an order you never intended.** Sources: Wordfence · CVE Program · http://WordPress.org · Vulnerability-Lookup