{
 "id": "WPSEC-2026-2907",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2907/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2907/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2907/index.md",
 "title": "Sensei LMS <= 4.26.4 - Unauthenticated Sensitive Information Exposure via Lesson Comment Feeds",
 "description": "The Sensei LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via comment feeds in all versions up to, and including, 4.26.4. This is due to the plugin only hiding the content of lessons a user cannot view through the post_password_required filter, which is registered only for REST API requests, and not filtering lesson comments out of the WordPress comment feeds. This makes it possible for unauthenticated attackers to read comments posted on lessons they are not allowed to view.",
 "plugin": {
  "slug": "sensei-lms",
  "name": "Sensei LMS",
  "full_name": "Sensei LMS – Online Courses, Quizzes, & Learning",
  "wordpress_org": "https://wordpress.org/plugins/sensei-lms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sensei-lms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sensei-lms"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.27.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.27.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.27.0",
 "remediation": "Update to 4.27.0 or later.",
 "fix_released": "2026-11-10T15:29:49+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:09:12.526349+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2907/",
  "https://plugins.svn.wordpress.org/sensei-lms/tags/4.27.0/",
  "https://wordpress.org/plugins/sensei-lms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sensei-lms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}