CVE-2024-8009

CWE-863 — Incorrect Authorization3 documents3 sources
Severity
4.3MEDIUM
EPSS
0.2%
top 60.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Unknown Sensei LMSAutomattic Sensei LMS
Timeline
PublishedMay 15

Description

The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages2 packages

▶CVEListV5unknown/sensei_lms< 4.20.0
▶NVDautomattic/sensei_lms< 4.20.0

🔴Vulnerability Details

2
GHSA
GHSA-v45r-44c3-w45r: The Sensei LMS WordPress plugin before 4↗2025-05-15
▶
CVEList
Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure↗2025-05-15
▶
CVE-2024-8009 (MEDIUM CVSS 4.3) | The Sensei LMS WordPress plugin bef | cvebase.io