Missing authorization in TutorStarter lets visitors create accounts
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers. Unauthenticated visitors can create WordPress user accounts even when user registration is disabled. The flaw is a missing authorization check (CWE-862), and an unauthenticated remote attacker can exploit it without user interaction. A public exploit is linked in the references.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | TutorStarter | before 4.0.4 | 4.0.4 | Patch available | CNA |
- TutorStarter VendorUnknown Affected before 4.0.4 Fixed in 4.0.4 Patch available CNA
Remediation
Update TutorStarter to version 4.0.4, which fixes the flaw.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA TutorStarter (Unknown) Fixed in 4.0.4
Timeline
- 2026-10-08 Threatist record created from CVE-2026-104671
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences