Sensei LMS <= 4.26.3 - Unauthenticated Sensitive Information Exposure via Restricted Lesson Content
- ID
- WPSEC-2026-0062
- Plugin
- Sensei LMS – Online Courses, Quizzes, & Learning (sensei-lms)
- Affected
- all versions before 4.26.4
- Remediation
- Update to 4.26.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Sensei LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Sensei LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.26.3. The limit_archive_content function, which cuts lesson content down to a teaser for visitors who may not view the lesson, only ran on the lesson post type archive. Any other front-end listing that renders lessons through the_content, such as a main query with the post type passed as an array (post_type[]=lesson), showed the full lesson body. The result depends on the theme. This makes it possible for unauthenticated attackers to read the full content of lessons in courses they are not enrolled in when the 'users must be logged in to view lesson content' setting is enabled (the default).
References
- https://wpsec.com/vuln/WPSEC-2026-0062/
- https://plugins.svn.wordpress.org/sensei-lms/tags/4.26.4/
- https://wordpress.org/plugins/sensei-lms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS