The Tutor LMS plugin for WordPress is vulnerable to the execution of arbitrary, zero‑argument PHP functions through the tutor_course_filter_ajax AJAX action. The handler lacks proper authorization checks and accepts unsanitized array keys that are passed to PHP’s extract() inside tutor_load_template(). This allows an attacker to overwrite local variables such as $template and inject a call to any function, including WordPress core’s edit_user(), to create a persistent subscriber‑level account. The result is remote code execution and the creation of an attacker‑controlled account with elevated privileges. This flaw is an example of CWE‑74, where unsanitized input is used in a risky context.

The vulnerability affects the Tutor LMS eLearning and online course solution plugin from Themeum. All releases up to and including version 4.0.5 are impacted; any WordPress installation that has the plugin installed is potentially exposed.

With a CVSS score of 6.5, the flaw carries a moderate severity rating. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog, so no current exploitation statistics are publicly documented. The straightforward attack vector is a web‑based, unauthenticated POST to the AJAX endpoint with crafted parameters, meaning any visitor to the site that hosts an affected plugin can trigger the exploit. Based on the description, it is inferred that the ability to create a new user account could enable unauthorized access and potential lateral movement within the site.