Sensei Lms
Monthly
Sensei LMS WordPress plugin versions before 4.26.4 contain a broken access control flaw in the legacy save_new_message handler, allowing any authenticated user, including an unprivileged Subscriber, to create a private message addressed to the author of an arbitrary course, lesson, or quiz post. The handler checks only a generic nonce and does not verify course enrollment or restrict post_id to valid post types, bypassing the enrollment checks in the newer REST send-message controller. Impact is limited to message/spam injection with low integrity impact; no public exploit identified at time of analysis and real-world risk is low-to-moderate.
Authenticated Teacher-role users can modify course content they do not own in Sensei LMS before 4.26.4 by abusing the add_new_module_term AJAX handler, which validates only a generic nonce rather than per-course edit permissions. Attackers can reuse a nonce from their own course metabox to call wp_set_object_terms against arbitrary course IDs, enabling unauthorized assignment of module taxonomy terms on courses owned by other teachers or administrators. No public exploit code has been identified at time of analysis; impact is integrity-only and most meaningful on multi-author sites, while single-instructor deployments have negligible exposure.
The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS - Online Courses, Quizzes, & Learning allows Stored XSS.17.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Sensei LMS WordPress plugin versions before 4.26.4 contain a broken access control flaw in the legacy save_new_message handler, allowing any authenticated user, including an unprivileged Subscriber, to create a private message addressed to the author of an arbitrary course, lesson, or quiz post. The handler checks only a generic nonce and does not verify course enrollment or restrict post_id to valid post types, bypassing the enrollment checks in the newer REST send-message controller. Impact is limited to message/spam injection with low integrity impact; no public exploit identified at time of analysis and real-world risk is low-to-moderate.
Authenticated Teacher-role users can modify course content they do not own in Sensei LMS before 4.26.4 by abusing the add_new_module_term AJAX handler, which validates only a generic nonce rather than per-course edit permissions. Attackers can reuse a nonce from their own course metabox to call wp_set_object_terms against arbitrary course IDs, enabling unauthorized assignment of module taxonomy terms on courses owned by other teachers or administrators. No public exploit code has been identified at time of analysis; impact is integrity-only and most meaningful on multi-author sites, while single-instructor deployments have negligible exposure.
The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak sensei_email and sensei_message Information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic Sensei LMS - Online Courses, Quizzes, & Learning allows Stored XSS.17.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Sensei LMS WordPress plugin before 4.5.2 does not ensure that the sender of a private message is either the teacher or the original sender, allowing any authenticated user to send messages to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.