CVE-2026-19093: Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root.
The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tutor LMS (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.0.6 - Operational
After upgrading to Tutor LMS 4.0.6 or later, rotate the WordPress database credentials and regenerate the authentication keys and salts because the WordPress configuration file could have been exposed, enabling forged authentication cookies.
Event History
Frequently Asked Questions
Which users can exploit this issue?
An authenticated user with the Tutor LMS instructor role can exploit it. The issue is relevant where instructor accounts exist and an attacker can obtain or control one.
What files could an attacker access?
The vulnerable media streaming behavior can read arbitrary server files, including files outside the web root. This includes the WordPress configuration file, which may expose database credentials and WordPress authentication keys and salts.
What is the impact if wp-config.php is read?
Exposure of the WordPress configuration file can reveal database credentials and authentication keys and salts. With the authentication material, an attacker can forge WordPress authentication cookies.