# Sensei LMS <= 4.26.4 - Unauthenticated Sensitive Information Exposure via Lesson Comment Feeds

- **ID:** WPSEC-2026-2907
- **Plugin:** Sensei LMS – Online Courses, Quizzes, & Learning (`sensei-lms`), https://wordpress.org/plugins/sensei-lms/
- **Affected versions:** all versions before 4.27.0
- **Fixed in:** 4.27.0 (Update to 4.27.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sensei-lms
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2907/

## Description

The Sensei LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via comment feeds in all versions up to, and including, 4.26.4. This is due to the plugin only hiding the content of lessons a user cannot view through the post_password_required filter, which is registered only for REST API requests, and not filtering lesson comments out of the WordPress comment feeds. This makes it possible for unauthenticated attackers to read comments posted on lessons they are not allowed to view.

## References

- https://wpsec.com/vuln/WPSEC-2026-2907/
- https://plugins.svn.wordpress.org/sensei-lms/tags/4.27.0/
- https://wordpress.org/plugins/sensei-lms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2907/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.