CVE-2022-2034: Automattic Sensei Lms

Medium severity, CVSS 5.3. EPSS: 2.5% chance of exploitation in the next 30 days.

The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers

Affected products

• Automattic Sensei Lms: before 4.5.0 (fixed in 4.5.0)

Published 2022-08-29. Last modified 2026-06-17.