Medium
TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX
The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.
Announced Group revision 1
Original source ↗CVE-2026-104671
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-104671
TutorStarter
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "TutorStarter",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "4.0.4",
"versionType": "semver"
}
],
"collectionURL": "https://wordpress.org/themes",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-104671
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #12427 · Revision 1
- Added to Heist Feed
- Publisher date