CVE-2026-19093: CWE-552 Files or Directories Accessible to External Parties in Tutor LMS

The Tutor LMS WordPress plugin prior to version 4.0.6 fails to validate stored file paths before using them to stream media content. This lack of validation permits users assigned the instructor role to access and read arbitrary files on the server filesystem, including files outside the web root directory. Among the accessible files is the WordPress configuration file (wp-config.php), which contains sensitive information such as database credentials and authentication keys and salts. Disclosure of these secrets could allow attackers to forge authentication cookies, potentially compromising site security.

Users with the instructor role can exploit this vulnerability to read arbitrary files on the server, including critical configuration files. This can lead to exposure of database credentials and authentication keys, increasing the risk of unauthorized access through forged authentication cookies. The vulnerability compromises confidentiality and could facilitate further attacks on the WordPress site.

A fix is available in Tutor LMS version 4.0.6. Users should upgrade to version 4.0.6 or later to remediate this vulnerability. No additional mitigation guidance is provided; applying the official update fully addresses the issue.