The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor… (CVE-2026-19093)
The Tutor LMS WordPress plugin versions before 4.0.6 contain a vulnerability where the plugin does not validate stored file paths before streaming media. This flaw allows users with the instructor role to read arbitrary files on the server, including sensitive files outside the web root such as the WordPress configuration file. Exposure of this configuration file can reveal database credentials and authentication keys, enabling potential cookie forgery.
AI Analysis
Technical Summary
The Tutor LMS WordPress plugin prior to version 4.0.6 fails to validate stored file paths before using them to stream media content. This lack of validation permits users assigned the instructor role to access and read arbitrary files on the server filesystem, including files outside the web root directory. Among the accessible files is the WordPress configuration file (wp-config.php), which contains sensitive information such as database credentials and authentication keys and salts. Disclosure of these secrets could allow attackers to forge authentication cookies, potentially compromising site security.
Potential Impact
Users with the instructor role can exploit this vulnerability to read arbitrary files on the server, including critical configuration files. This can lead to exposure of database credentials and authentication keys, increasing the risk of unauthorized access through forged authentication cookies. The vulnerability compromises confidentiality and could facilitate further attacks on the WordPress site.
Mitigation Recommendations
A fix is available in Tutor LMS version 4.0.6. Users should upgrade to version 4.0.6 or later to remediate this vulnerability. No additional mitigation guidance is provided; applying the official update fully addresses the issue.
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor… (CVE-2026-19093)
Description
The Tutor LMS WordPress plugin versions before 4.0.6 contain a vulnerability where the plugin does not validate stored file paths before streaming media. This flaw allows users with the instructor role to read arbitrary files on the server, including sensitive files outside the web root such as the WordPress configuration file. Exposure of this configuration file can reveal database credentials and authentication keys, enabling potential cookie forgery.
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Tutor LMS WordPress plugin prior to version 4.0.6 fails to validate stored file paths before using them to stream media content. This lack of validation permits users assigned the instructor role to access and read arbitrary files on the server filesystem, including files outside the web root directory. Among the accessible files is the WordPress configuration file (wp-config.php), which contains sensitive information such as database credentials and authentication keys and salts. Disclosure of these secrets could allow attackers to forge authentication cookies, potentially compromising site security.
Potential Impact
Users with the instructor role can exploit this vulnerability to read arbitrary files on the server, including critical configuration files. This can lead to exposure of database credentials and authentication keys, increasing the risk of unauthorized access through forged authentication cookies. The vulnerability compromises confidentiality and could facilitate further attacks on the WordPress site.
Mitigation Recommendations
A fix is available in Tutor LMS version 4.0.6. Users should upgrade to version 4.0.6 or later to remediate this vulnerability. No additional mitigation guidance is provided; applying the official update fully addresses the issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m8r7-xfwf-2vw8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19093"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a89a6caacd9273b49150b44
Added to database: 08/22/2026, 13:40:26 UTC
Last enriched: 08/22/2026, 13:42:29 UTC
Last updated: 08/22/2026, 20:51:58 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.