CVE-2026-19093: Tutor LMS Information Disclosure Flaw

CVE-2026-19093 Overview

CVE-2026-19093 is an arbitrary file read vulnerability in the Tutor LMS WordPress plugin before version 4.0.6. The plugin fails to validate a stored file path before using it to stream media content. Authenticated users holding the instructor role can leverage this flaw to read arbitrary files on the server, including files located outside the web root. Readable content includes the WordPress wp-config.php file, which exposes database credentials along with authentication keys and salts. Attackers can use the exposed salts to forge authentication cookies and impersonate any WordPress user, including administrators. The issue is categorized under CWE-552 (Files or Directories Accessible to External Parties).

Critical Impact
An authenticated instructor can read wp-config.php, extract authentication keys and salts, and forge cookies to escalate to administrator.

Affected Products

Tutor LMS WordPress plugin versions prior to 4.0.6
WordPress installations running vulnerable Tutor LMS releases
Any hosting environment where WordPress process users can read server files outside the web root

Discovery Timeline

2026-08-22 - CVE-2026-19093 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-19093

Vulnerability Analysis

The Tutor LMS plugin implements a media streaming feature that reads a file path from stored data and returns the file contents to the requester. The plugin does not verify that the stored path resolves to an allowed directory before opening the file. An instructor-level user can influence the stored path to point to arbitrary locations on the underlying filesystem. When the streaming endpoint is invoked, the plugin reads and returns those bytes to the attacker.

Because WordPress typically runs as a user with read access to the entire web root, the attacker can retrieve wp-config.php. This file contains database credentials and the AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and matching salt constants. With the salts in hand, an attacker can forge valid WordPress authentication cookies for administrator accounts, bypassing the login process entirely.

Root Cause

The root cause is missing path validation before file access. The plugin trusts a file path stored in the database and passes it directly to file read routines without canonicalizing the path, comparing it against an allowlist of directories, or rejecting traversal sequences. This aligns with CWE-552.

Attack Vector

Exploitation requires an authenticated user with the instructor role on the target WordPress site. The attacker manipulates the stored media path associated with a lesson or media item, then invokes the media streaming endpoint to trigger the read. The endpoint returns the raw contents of the targeted file. No user interaction from a victim is required, and the request is delivered over the network to the WordPress site. Full technical details are available in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-19093

Indicators of Compromise

Requests to Tutor LMS media streaming endpoints originating from instructor accounts and returning unusually large or non-media payloads
Access log entries where the response content-type does not match an expected media MIME type
Database records in Tutor LMS tables containing file paths with .. sequences or absolute paths outside the WordPress uploads directory
Unexpected administrator logins from IPs previously associated with instructor accounts

Detection Strategies

Audit Tutor LMS media path columns for values that resolve outside wp-content/uploads
Correlate web server access logs with WordPress user roles to flag instructor accounts requesting media endpoints at high rates
Alert on any successful HTTP 200 response from the streaming endpoint whose byte pattern matches PHP source markers such as <?php or the string DB_PASSWORD

Monitoring Recommendations

Monitor file access on wp-config.php at the operating system level and alert on reads by the web server user outside of normal WordPress bootstrapping
Track creation and modification of Tutor LMS lesson and attachment records by instructor accounts
Watch for authentication cookie reuse from new IP addresses shortly after suspicious streaming requests

How to Mitigate CVE-2026-19093

Immediate Actions Required

Update the Tutor LMS plugin to version 4.0.6 or later on all WordPress sites
Rotate all secrets in wp-config.php, including AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY, and their salts, to invalidate any forged cookies
Rotate the WordPress database user password referenced by DB_PASSWORD
Review instructor accounts for unauthorized additions and audit administrator account activity since the plugin was installed

Patch Information

The vendor addressed the issue in Tutor LMS 4.0.6 by validating stored media paths before streaming. See the WPScan Vulnerability Report for advisory references.

Workarounds

Restrict the instructor role to trusted users only until the plugin can be updated
Deploy a web application firewall rule that blocks Tutor LMS media streaming requests containing path traversal sequences
Configure filesystem permissions so the WordPress process user cannot read files outside the web root, including moving wp-config.php one directory above the web root where the hosting layout permits

bash

# Example: restrict wp-config.php permissions and disallow web-user reads outside web root
chmod 600 /var/www/html/wp-config.php
chown root:www-data /var/www/html/wp-config.php