[ CVE-2026-104671 · Published 8 Oct 2026 ]
Vulnerability in Unknown TutorStarter
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.