CVE-2022-2034

medium

Description

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

References

https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426

https://hackerone.com/reports/1590237

Details

Source: Mitre, NVD

Published: 2022-08-29

Updated: 2026-06-17

Risk Information

CVSS v2

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.3

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N