PT-2025-3902 · WordPress · Sensei Lms

Li Xuhang · Published 2025-02-04 · Updated 2025-09-30 · CVE-2025-0466

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Sensei LMS WordPress plugin versions prior to 4.24.4

Description The issue concerns the inadequate protection of some REST API routes in the Sensei LMS WordPress plugin, allowing unauthenticated attackers to leak information related to sensei email and sensei message.

Recommendations For Sensei LMS WordPress plugin versions prior to 4.24.4, update to version 4.24.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable REST API routes until a patch is applied.

Exploit

Fix

Related Identifiers

CVE-2025-0466

Affected Products

Sensei Lms

References · 9

• 🔥 https://wpscan.com/vulnerability/53ab86dc-1195-4ba0-8eda-6a0d7b45c45f · Exploit
• https://osv.dev/vulnerability/CVE-2025-0466 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0466 · Security Note
• https://t.me/cvenotify/122025 · Telegram Post
• https://twitter.com/CVEnew/status/1886660846383767974 · Twitter Post
• https://t.me/cvenotify/109808 · Telegram Post
• https://t.me/cveNotify/133675 · Telegram Post
• https://t.me/cveNotify/136977 · Telegram Post
• https://t.me/cvedetector/17144 · Telegram Post