CVE-2026-19093: CWE-552 Files or Directories Accessible to External Parties in Tutor LMS
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.
AI Analysis
Technical Summary
The Tutor LMS WordPress plugin prior to version 4.0.6 does not properly validate stored file paths before streaming media files. This flaw permits users assigned the instructor role to access arbitrary files on the server, including files outside the web root directory. Among the accessible files is the WordPress configuration file (wp-config.php), which contains sensitive information like database credentials and authentication keys and salts. Exposure of these secrets can allow attackers to forge authentication cookies, potentially compromising site security. No CVSS score or official remediation details are currently available.
Potential Impact
Users with the instructor role can read arbitrary server files, including sensitive configuration files that contain database credentials and authentication keys. This exposure can lead to unauthorized access to the database and allow attackers to forge authentication cookies, potentially leading to full site compromise or privilege escalation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict instructor role permissions and monitor for suspicious activity related to file access. Avoid assigning the instructor role to untrusted users.
CVE-2026-19093: CWE-552 Files or Directories Accessible to External Parties in Tutor LMS
Description
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Tutor LMS WordPress plugin prior to version 4.0.6 does not properly validate stored file paths before streaming media files. This flaw permits users assigned the instructor role to access arbitrary files on the server, including files outside the web root directory. Among the accessible files is the WordPress configuration file (wp-config.php), which contains sensitive information like database credentials and authentication keys and salts. Exposure of these secrets can allow attackers to forge authentication cookies, potentially compromising site security. No CVSS score or official remediation details are currently available.
Potential Impact
Users with the instructor role can read arbitrary server files, including sensitive configuration files that contain database credentials and authentication keys. This exposure can lead to unauthorized access to the database and allow attackers to forge authentication cookies, potentially leading to full site compromise or privilege escalation.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict instructor role permissions and monitor for suspicious activity related to file access. Avoid assigning the instructor role to untrusted users.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-06T13:04:30.179Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a893cc5acd9273b49a6fea0
Added to database: 08/22/2026, 06:08:05 UTC
Last enriched: 08/22/2026, 06:22:42 UTC
Last updated: 08/22/2026, 11:05:21 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.