Description
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Sensei LMS | < 4.5.0 | 4.5.0 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WordPress Sensei LMS <4.5.0 - Information Disclosure http/cves/2022/CVE-2022-2034.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426 exploit vdb-entry technical-description
- https://hackerone.com/reports/1590237