Quick answers
- Is CVE-2026-19093 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-19093 being exploited in the wild.
- How severe is CVE-2026-19093?
- Medium severity, with a CVSS score of 6.8, published 22 August 2026.
- Which products and versions are affected?
- WPML Tutor LMS before 4.0.6.
- Is there a fix for CVE-2026-19093?
- A patch was published on 2026-08-22: Version 4.0.6 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-19093 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-19093?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a path traversal / arbitrary file read flaw in Tutor LMS versions before 4.0.6. The lesson-save AJAX handler accepts user-supplied file paths in the video metadata without validation, storing them verbatim to the database. When a lesson video is requested via the frontend, the plugin streams the file at the attacker-supplied path without sanitization, allowing an instructor to read any file accessible to the web server process. The attack requires the tutor_instructor role (granted by administrator approval) and leverages an unauthenticated front-end nonce available to all visitors. An attacker can retrieve /etc/passwd, wp-config.php (containing database credentials and AUTH_KEY/SECURE_AUTH_KEY/LOGGED_IN_SALT constants), and other sensitive files. The issue was patched in version 4.0.6.
Affected products
- WPML Tutor LMS before 4.0.6
Timeline
- 2026-08-20: disclosed
- 2026-08-22: patched: Version 4.0.6 released