CVE-2026-104671 — TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX

CVE-2026-104671

TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX PUBLISHED

Description (CNA)

The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.

Affected (CNA)

Vendor / product	Versions
Unknown / TutorStarter	affected 0 before 4.0.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/6ecea67e-8019-4ef2-bd27-a9da7dc27d43/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.