{
 "id": "WPSEC-2026-2908",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2908/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2908/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2908/index.md",
 "title": "Sensei LMS <= 4.26.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Quiz Question Set",
 "description": "The Sensei LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via the quiz question set in all versions up to, and including, 4.26.4. This is due to the quiz save, submit and pagination handlers storing the client-supplied questions_asked post IDs as the questions asked in a submission without verifying them, and to the quiz renderer loading those IDs with get_post() without checking that they are questions. This makes it possible for authenticated attackers, with Subscriber-level access and above who can take a quiz, to have the title and content of arbitrary posts, including private and draft posts and questions from other quizzes, rendered to them on the quiz page, and to change the set of questions recorded for their submission.",
 "plugin": {
  "slug": "sensei-lms",
  "name": "Sensei LMS",
  "full_name": "Sensei LMS – Online Courses, Quizzes, & Learning",
  "wordpress_org": "https://wordpress.org/plugins/sensei-lms/",
  "advisories_url": "https://wpsec.com/vuln/plugin/sensei-lms/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/sensei-lms"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.27.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.27.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.27.0",
 "remediation": "Update to 4.27.0 or later.",
 "fix_released": "2026-11-10T15:29:49+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:09:12.526349+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2908/",
  "https://plugins.svn.wordpress.org/sensei-lms/tags/4.27.0/",
  "https://wordpress.org/plugins/sensei-lms/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/sensei-lms",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}