CVE-2024-7786: Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak
Published Sep 4, 2024
·Updated
The Sensei LMS WordPress plugin before 4.24.2 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak email templates.
Affected Software
1 affected component
Automattic Sensei Lms Wordpress<4.24.2
Event History
Sep 4, 2024
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverity
Dec 6, 56679
Event
via FIRST·04:40 PM
Frequently Asked Questions
1
What is the severity of CVE-2024-7786?
The severity of CVE-2024-7786 is considered to be medium as it allows unauthenticated attackers to access sensitive information.
2
How do I fix CVE-2024-7786?
To fix CVE-2024-7786, update the Sensei LMS WordPress plugin to version 4.24.2 or later.
3
What kind of data can be leaked due to CVE-2024-7786?
CVE-2024-7786 allows attackers to leak email templates from the Sensei LMS plugin.
4
Which versions of the Sensei LMS plugin are affected by CVE-2024-7786?
CVE-2024-7786 affects all versions of the Sensei LMS plugin before 4.24.2.
5
Is authentication required to exploit CVE-2024-7786?
No, CVE-2024-7786 can be exploited by unauthenticated attackers.