Vulnerabilities > CVE-2022-2034 - Authorization Bypass Through User-Controlled Key vulnerability in Automattic Sensei LMS
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
LOW Integrity impact
NONE Availability impact
NONE Summary
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers