Themes Vulnerabilities

TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX

Description

The theme does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.

Proof of Concept

Affects Themes

tutorstarter
Fixed in 4.0.4

References

CVE
CVE-2026-104671

Miscellaneous

Original Researcher
Alexander Jurkschat
Submitter
Alexander Jurkschat
Submitter website
https://ajsec.xyz/
Verified
Yes
WPVDB ID
6ecea67e-8019-4ef2-bd27-a9da7dc27d43

Timeline

Publicly Published
2026-10-06 (about 2 days ago)
Added
2026-10-06 (about 1 day ago)
Last Updated
2026-10-06 (about 1 day ago)

Other

Published
Title
Published
2021-01-20
Title
123ContactForm for WordPress <= 1.5.6 - Unauthenticated Arbitrary Post Creation
Published
2020-05-19
Title
WP Frontend Profile < 1.2.2 - CSRF Check Incorrectly Implemented
Published
2017-09-08
Title
BackWPup <= 3.4.1 - Backup File Download
Published
2026-07-13
Title
Simple Membership < 4.7.7 - Unauthenticated Payment Bypass via Missing PayPal IPN Receiver Verification
Published
2020-01-27
Title
WPS Hide Login < 1.5.5 - Secret Login Page Disclosure