Critical · 9.8 CVE-2025-64236 EUVD-2025-204294GHSA-557x-v644-wj6q

WordPress Tuturn plugin < 3.6 - Broken Authentication vulnerability

Published Dec 18, 2025 · Updated Apr 28, 2026 · Assigned by Patchstack

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a before 3.6.

Affected products

Vendor	Product	Affected	Fixed
AmentoTech	Tuturn	< 3.6	3.6

References

https://patchstack.com/database/wordpress/plugin/tuturn/vulnerability/wordpress-tuturn-plugin-3-6-broken-authentication-vulnerability?_s_id=cve vdb-entry