Executive brief
Tutor LMS is a popular WordPress plugin for creating and managing online courses. The plugin fails to validate file paths when serving course videos, allowing instructors to read arbitrary files from the server including the WordPress configuration file. This exposes sensitive data such as database passwords and security keys that can be used to forge authentication cookies and gain unauthorized access to the website.
Technical details
The vulnerability is a path traversal / arbitrary file read flaw in Tutor LMS versions before 4.0.6. The lesson-save AJAX handler accepts user-supplied file paths in the video metadata without validation, storing them verbatim to the database. When a lesson video is requested via the frontend, the plugin streams the file at the attacker-supplied path without sanitization, allowing an instructor to read any file accessible to the web server process. The attack requires the tutor_instructor role (granted by administrator approval) and leverages an unauthenticated front-end nonce available to all visitors. An attacker can retrieve /etc/passwd, wp-config.php (containing database credentials and AUTH_KEY/SECURE_AUTH_KEY/LOGGED_IN_SALT constants), and other sensitive files. The issue was patched in version 4.0.6.
Affected products
- WPML Tutor LMS before 4.0.6
Timeline
- 2026-08-20: disclosed
- 2026-08-22: patched: Version 4.0.6 released