The Tutor LMS WordPress plugin fails to validate a stored file path before using it to stream media. An instructor user can supply a video path that points to any file on the server, including files outside the web root. This flaw enables reading arbitrary server files; for example, the WordPress configuration file is exposed, revealing database credentials and cryptographic salts used for cookie authentication.

All installations of the Tutor LMS WordPress plugin with a version earlier than 4.0.6 are affected. Any site that has the plugin installed and has users assigned the instructor role can exploit the issue.

No EPSS score is published and the vulnerability is not listed in CISA’s KEV catalog, indicating no publicly documented exploitation yet. However, the ability to read the wp-config file provides attackers with credentials to forge authentication cookies, potentially allowing full control of the WordPress site. The attack requires an instructor account and the use of the video path functionality, which suggests that lateral movement to an instructor account could enable exploitation.