Sensei LMS <= 4.26.3 - Unauthenticated Sensitive Information Exposure via Quiz Answer File Uploads

ID

WPSEC-2026-0065

Plugin

Sensei LMS – Online Courses, Quizzes, & Learning (sensei-lms)

Affected

all versions before 4.26.4

Remediation

Update to 4.26.4 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness

CWE-200

Usage

Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22

Attack surface

Sensei LMS on WPSec AttackSurface

Fix released

2026-09-29

Published

2026-10-01

Description

The Sensei LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.26.3. Sensei_Utils::upload_file() saved files that students upload as quiz answers as attachments with the 'inherit' status and no parent post. WordPress treats such attachments as public, so they are listed by the REST API media endpoint and have attachment pages. This makes it possible for unauthenticated attackers to list and download files that other students submitted as quiz answers.

References

• https://wpsec.com/vuln/WPSEC-2026-0065/
• https://plugins.svn.wordpress.org/sensei-lms/tags/4.26.4/
• https://wordpress.org/plugins/sensei-lms/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS