Vulnerabilities > CVE-2022-2034 - Authorization Bypass Through User-Controlled Key vulnerability in Automattic Sensei LMS

047910
CVSS 5.3 - MEDIUM
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
LOW
Integrity impact
NONE
Availability impact
NONE
network
low complexity
automattic
CWE-639

Summary

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

Vulnerable Configurations

Part Description Count
Application
Automattic
52