Vulnerabilities / Sensei LMS / WPSEC-2026-2907
Sensei LMS <= 4.26.4 - Unauthenticated Sensitive Information Exposure via Lesson Comment Feeds
Medium 5.3
CWE-200Fixed in 4.27.0
- ID
- WPSEC-2026-2907
- Plugin
- Sensei LMS – Online Courses, Quizzes, & Learning (sensei-lms)
- Affected
- all versions before 4.27.0
- Remediation
- Update to 4.27.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Sensei LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Sensei LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via comment feeds in all versions up to, and including, 4.26.4. This is due to the plugin only hiding the content of lessons a user cannot view through the post_password_required filter, which is registered only for REST API requests, and not filtering lesson comments out of the WordPress comment feeds. This makes it possible for unauthenticated attackers to read comments posted on lessons they are not allowed to view.
References
- https://wpsec.com/vuln/WPSEC-2026-2907/
- https://plugins.svn.wordpress.org/sensei-lms/tags/4.27.0/
- https://wordpress.org/plugins/sensei-lms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS