CVE-2026-19093: CWE-552 Files or Directories Accessible to External Parties in Tutor LMS

The Tutor LMS WordPress plugin prior to version 4.0.6 does not properly validate stored file paths before streaming media files. This flaw permits users assigned the instructor role to access arbitrary files on the server, including those outside the web root directory. Notably, the vulnerability exposes the wp-config.php file, which contains critical database credentials and authentication keys and salts. Exposure of these secrets can allow attackers to forge authentication cookies, compromising site security. The CVSS 3.1 base score is 6.8, reflecting a medium severity with network attack vector, low attack complexity, and high confidentiality impact but no integrity or availability impact.

Users with the instructor role can read arbitrary files on the server, including sensitive configuration files like wp-config.php. This exposure risks disclosure of database credentials and authentication keys, which can lead to forged authentication cookies and unauthorized access to the WordPress site. There is no direct impact on data integrity or availability reported.

A fixed version of Tutor LMS is available at version 4.0.6. Users should upgrade to version 4.0.6 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.