PT-2024-38580 · WordPress · Sensei Lms

Sushmita Poudel · Published 2024-09-03 · Updated 2024-10-07 · CVE-2024-7786

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The Sensei LMS WordPress plugin versions prior to 4.24.2

Description The issue concerns the Sensei LMS WordPress plugin, where some of its REST API routes are not properly protected, allowing unauthenticated attackers to leak email templates.

Recommendations For versions prior to 4.24.2, update to version 4.24.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable REST API routes until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2024-7786

Affected Products

Sensei Lms

References · 8

• 🔥 https://wpscan.com/vulnerability/f44e6f8f-3ef2-45c9-ae9c-9403305a548a · Exploit
• https://osv.dev/vulnerability/CVE-2024-7786 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7786 · Security Note
• https://twitter.com/VulmonFeeds/status/1831288217921806813 · Twitter Post
• https://twitter.com/CVEnew/status/1831221643986833536 · Twitter Post
• https://twitter.com/cracbot/status/1832660259330257052 · Twitter Post
• https://t.me/cvedetector/4752 · Telegram Post
• https://t.me/cvenotify/97321 · Telegram Post