Back Ciberseguridadlatam

Tutor LMS expone credenciales de WordPress por falta de validación de rutas

Ciberseguridadlatam •Redacción CSL • August 24, 2026

Una falla en el plugin permite a instructores leer archivos críticos del servidor, incluido wp-config.php con claves de base de datos y autenticación. El plugin Tutor LMS para WordPress, utilizado por miles de sitios de e-learning en todo el mundo, presenta una vulnerabilidad catalogada como CVE-2026-19093 que permite a usuarios con rol de instructor acceder […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Tutor LMS Plugin Exposes WordPress Credentials Due to Route Validation Flaw A vulnerability in the Tutor LMS plugin for WordPress, identified as CVE-2026-19093, allows instructors to access critical server files, including wp-config.php, which contains database and authentication keys. This flaw affects thousands of e-learning sites globally, posing a significant risk to sensitive information. The vulnerability was published on 2026-08-22, and its exploitation could lead to unauthorized access to databases and potential data breaches. Administrators of affected sites are urged to take immediate action to mitigate risks. The plugin is widely used, increasing the scope of potential impact across various educational platforms. 2 sources 72

Extracted Entities

Tutor LMS expone credenciales de WordPress por falta de validación de rutas

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)