Vulnerabilities / Sensei LMS / WPSEC-2026-0066
Sensei LMS <= 4.26.3 - Unauthenticated Sensitive Information Exposure via Private Messages
Medium 5.3
CWE-200Fixed in 4.26.4
- ID
- WPSEC-2026-0066
- Plugin
- Sensei LMS – Online Courses, Quizzes, & Learning (sensei-lms)
- Affected
- all versions before 4.26.4
- Remediation
- Update to 4.26.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Sensei LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Sensei LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via private messages in all versions up to, and including, 4.26.3. The privacy checks for sensei_message posts only ran when the 'post_type' query var was a string, so passing it as an array (post_type[]=sensei_message) skipped them. The post type was also embeddable through oEmbed, and message permalinks and canonical redirects exposed slugs generated from the message body. This makes it possible for unauthenticated attackers to list and read private messages exchanged between students and teachers.
References
- https://wpsec.com/vuln/WPSEC-2026-0066/
- https://plugins.svn.wordpress.org/sensei-lms/tags/4.26.4/
- https://wordpress.org/plugins/sensei-lms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS