EIP-2026-114127

This exploit demonstrates a Local File Inclusion (LFI) vulnerability in the WordPress Tutor plugin version 1.5.3. The vulnerability arises from improper sanitization of the 'sub_page' parameter in 'instructors.php', allowing an attacker to include arbitrary local files.