CVE-2026-19093 is a path traversal vulnerability in Tutor LMS that exposes a conceptual failure more than a missing sanitize() call. The plugin's media streaming endpoint retrieves file paths that were stored during content configuration — presumably when an instructor uploads course material — and uses those paths without re-validating that they stay within the application's content directory. The developer likely trusted the stored path because it was 'my application stored this' without recognizing that the validation performed at upload time (is this a valid course video?) is categorically different from what the streaming endpoint needs: does this path remain within authorized filesystem boundaries?
This is a stored-path trust collapse: the write operation creates a boundary that the read operation silently crosses. The vulnerability succeeds not because the developer forgot input validation, but because they never conceptualized that a media streaming endpoint could reach wp-config.php. The application-layer authorization model — 'is this user enrolled?' — and the infrastructure-layer access control model — 'what files can the server process read?' — were handled by different mental models that were never reconciled.
The CVSS 6.8 score is misleading. This is not a medium-severity data exposure. Arbitrary file read to wp-config.php means access to authentication salts, which directly enable session forgery. An attacker with instructor role (a role many sites distribute liberally because course content management feels low-risk) can read wp-config.php, extract the salts, forge an administrator session, install malicious plugins, and pivot to the host. The blast radius is a complete authentication bypass, not data disclosure.
The capability shouldn't have existed in the feature's design. Streaming course videos does not require the server process to read arbitrary filesystem locations. The original feature requirement calcified into a persistent capability that nobody revisited as threat models narrowed. Every installation running Tutor LMS with streaming enabled accumulated exposure debt from the moment that feature shipped.
Prioritize patching this vulnerability. The fix in version 4.0.6 presumably adds realpath() or path containment checks to the streaming endpoint — verify that the deployed version matches or exceeds this release. Beyond patching, treat the instructor role as a high-privilege account category for security review purposes: any WordPress feature accessible to instructors should be audited for filesystem interaction points. The WordPress plugin ecosystem's shared filesystem access and global namespace architecture systematically encourage developers to conflate 'user authorization within my plugin' with 'user authorization to access server resources' — this pattern has a CVE lineage stretching back at least fifteen years in PHP application security.