CVSS 3.1
5.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVE-2022-2034
Medium (5.3) in automattic sensei lms. EPSS 2.7% chance of exploitation in the next 30 days.
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
Severity
- EPSS
- 2.7% chance of exploitation in the next 30 days; higher than 85% of CVEs (scores of 2026-10-31)
- CWE
- CWE-639
- Published
- Modified
- Record from
- the NVD, synced
Affected
- automattic:sensei_lms