Description

The Tutor LMS WordPress plugin before 4.0.6 does not validate a stored file path before using it to stream media, allowing users with the instructor role to read arbitrary files on the server, including files outside the web root. The readable files include the WordPress configuration file, which exposes the database credentials and the authentication keys and salts, so authentication cookies can be forged.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-22T06:16:15.900Z",
  "pubdate": "2026-08-22T06:16:15.900Z",
  "executiveSummary": "The Tutor LMS WordPress plugin before 4.0.6 is susceptible to an arbitrary file read vulnerability stemming from insufficient input validation of stored file paths during media streaming operations.\nThis security flaw allows malicious actors possessing the instructor role to access, read, and exfiltrate arbitrary files located on the underlying server, including sensitive files residing completely outside the designated web root directory.\nThe potential impact is critical, as successfully read files include the core WordPress configuration file, which explicitly exposes sensitive database credentials, cryptographic authentication keys, and security salts.\nCompromise of these sensitive configuration assets inherently enables advanced post-exploitation scenarios, notably the capability to forge authentication cookies and achieve full administrative account takeover or lateral movement across the hosting environment.\nRisk implications are high due to the exposure of infrastructure credentials and systemic application compromise.\nExploitation requires authenticated access with the instructor role within the WordPress application, targeting the media streaming functionality of the vulnerable plugin versions.",
  "technicalDetails": "The root cause of the vulnerability resides in the media streaming component of the Tutor LMS WordPress plugin, which fails to properly validate, sanitize, or restrict stored file paths before using them in file retrieval and read operations.\nThe vulnerable component processes user-supplied or stored file paths without implementing adequate path traversal defenses, such as canonicalization checks via realpath() or strict whitelisting against a safe directory base.\nBecause path traversal sequences or absolute paths are not properly filtered, an authenticated user with the instructor role can manipulate the file path parameter within the media streaming mechanism to traverse the filesystem hierarchy outside the web root.\nThe step-by-step attack flow begins with an authenticated attacker holding the instructor role identifying the endpoint responsible for streaming media within the Tutor LMS plugin.\nThe attacker crafts a malicious request supplying a targeted absolute file path or directory traversal payload designed to point to sensitive system files.\nUpon receiving the request, the vulnerable plugin code passes the unvalidated path directly to file reading functions without verifying that the requested resource falls within the authorized media directory boundaries.\nThe server reads the targeted file and streams its contents back in the HTTP response to the attacker.\nPost-exploitation impact is severe because the readable files include the WordPress configuration file, which contains cleartext database credentials and cryptographic authentication keys and salts.\nWith access to the authentication keys and salts, an attacker can forge valid authentication cookies, effectively bypassing standard authentication controls and gaining administrative privileges over the WordPress instance.\nThe vulnerability affects the Tutor LMS WordPress plugin for all versions prior to 4.0.6, requiring network access to the WordPress application and specific privilege requirements limited to the instructor role."
}