blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-19093

MEDIUM 6.8 CVSS 3.1
Published
August 22, 2026
Last modified
October 12, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-552
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Description

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.

Affected products and versions

  • Unknown Tutor LMS — Before 4.0.6

References

  • wpscan.com https://wpscan.com/vulnerability/9f8361a9-d424-4346-9d92-6f27ab9261c9/
  • nvd.nist.gov Official NVD record