Sensei LMS <= 4.26.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Quiz Question Set
- ID
- WPSEC-2026-2908
- Plugin
- Sensei LMS – Online Courses, Quizzes, & Learning (sensei-lms)
- Affected
- all versions before 4.27.0
- Remediation
- Update to 4.27.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-12
- Attack surface
- Sensei LMS on WPSec AttackSurface
- Fix released
- Published
Description
The Sensei LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via the quiz question set in all versions up to, and including, 4.26.4. This is due to the quiz save, submit and pagination handlers storing the client-supplied questions_asked post IDs as the questions asked in a submission without verifying them, and to the quiz renderer loading those IDs with get_post() without checking that they are questions. This makes it possible for authenticated attackers, with Subscriber-level access and above who can take a quiz, to have the title and content of arbitrary posts, including private and draft posts and questions from other quizzes, rendered to them on the quiz page, and to change the set of questions recorded for their submission.
References
- https://wpsec.com/vuln/WPSEC-2026-2908/
- https://plugins.svn.wordpress.org/sensei-lms/tags/4.27.0/
- https://wordpress.org/plugins/sensei-lms/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS