# Sensei LMS <= 4.26.4 - Authenticated (Subscriber+) Sensitive Information Exposure via Quiz Question Set

- **ID:** WPSEC-2026-2908
- **Plugin:** Sensei LMS – Online Courses, Quizzes, & Learning (`sensei-lms`), https://wordpress.org/plugins/sensei-lms/
- **Affected versions:** all versions before 4.27.0
- **Fixed in:** 4.27.0 (Update to 4.27.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/sensei-lms
- **Fix released:** 2026-11-10
- **Published:** 2026-11-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2908/

## Description

The Sensei LMS plugin for WordPress is vulnerable to Sensitive Information Exposure via the quiz question set in all versions up to, and including, 4.26.4. This is due to the quiz save, submit and pagination handlers storing the client-supplied questions_asked post IDs as the questions asked in a submission without verifying them, and to the quiz renderer loading those IDs with get_post() without checking that they are questions. This makes it possible for authenticated attackers, with Subscriber-level access and above who can take a quiz, to have the title and content of arbitrary posts, including private and draft posts and questions from other quizzes, rendered to them on the quiz page, and to change the set of questions recorded for their submission.

## References

- https://wpsec.com/vuln/WPSEC-2026-2908/
- https://plugins.svn.wordpress.org/sensei-lms/tags/4.27.0/
- https://wordpress.org/plugins/sensei-lms/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2908/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.