Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-104671

TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX

Description

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown TutorStarter

Default version status: unaffected

  • 0 to < 4.0.4affected

References