What’s Vulnerable › Vulnerabilities
CVE-2026-19093: Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.5% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-22 · updated 2026-10-12
- Weakness: CWE-552
Description
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.
Affected products
- themeum Tutor LMS – eLearning and online course solution: before 4.0.6 — fixed in 4.0.6
How to fix
Upgrade to a fixed version: themeum Tutor LMS – eLearning and online course solution 4.0.6. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-19093 or the next vulnerability affects your stack