CVE-2022-2034

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

2.53% chance of exploitation in the next 30 days, 84th percentile

Nuclei

medium · CWE-639

Published

2022-08-29

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-2034.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2022-20338
• CVE-2022-2035
• CVE-2022-2029
• CVE-2022-2036
• CVE-2022-2028
• CVE-2022-20360