CVE-2024-7786

Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak

The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.

Affected

Sensei LMS

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v3.1 CNA

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

1.75% chance of exploitation in the next 30 days, 77th percentile

Nuclei

high

Published

2024-09-04

Updated

2025-08-27

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/f44e6f8f-3ef2-45c9-ae9c-9403305a548a/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-7786.yaml

Security advisories

• https://wpscan.com/vulnerability/f44e6f8f-3ef2-45c9-ae9c-9403305a548a

References

• CVE Record
• NVD entry