What’s Vulnerable › Vulnerabilities

CVE-2022-2034: Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-08-29 · updated 2026-06-17
• Weakness: CWE-639

Description

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

Affected products

• Sensei LMS: before 4.5.0 — fixed in 4.5.0

How to fix

Upgrade to a fixed version: Sensei LMS 4.5.0. Check the vendor advisory for mitigations.

References

• https://hackerone.com/reports/1590237
• https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426
• https://hackerone.com/reports/1590237
• https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426

Get alerted when CVE-2022-2034 or the next vulnerability affects your stack