CVE-2026-19093 Tutor LMS < 4.0.6 - Instructor+ Arbitrary File Read via Video Path
Instructors can read arbitrary server files, including configuration files, to steal credentials and forge authentication cookies.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19093?
CVE-2026-19093 is a medium-severity path traversal vulnerability in Unknown Tutor LMS, published on 22 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root.
The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.
Weakness: CWE-552
Which versions are affected by CVE-2026-19093?
How do I fix CVE-2026-19093?
No fix has been published for CVE-2026-19093 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-19093 being exploited?
There is no known exploitation of CVE-2026-19093 in the wild and no public exploit code.
Sources
Also known as GHSA-m8r7-xfwf-2vw8.