CVE-2025-0466: Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message Disclosure
Published Feb 4, 2025
·Updated
The Sensei LMS WordPress plugin before 4.24.4 does not properly protect some its REST API routes, allowing unauthenticated attackers to leak senseiemail and senseimessage Information.
Affected Software
2 affected components
Sensei LMS<4.24.4
Automattic Sensei Lms Wordpress<4.24.4
Event History
Feb 4, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-0466?
CVE-2025-0466 has a high severity rating due to the potential for unauthorized data exposure.
2
How do I fix CVE-2025-0466?
To mitigate CVE-2025-0466, update the Sensei LMS WordPress plugin to version 4.24.4 or later.
3
What information can be leaked due to CVE-2025-0466?
CVE-2025-0466 allows attackers to leak sensitive information including sensei_email and sensei_message.
4
Which versions of the Sensei LMS plugin are affected by CVE-2025-0466?
CVE-2025-0466 affects all versions of the Sensei LMS plugin prior to 4.24.4.
5
Are there any known exploitation methods for CVE-2025-0466?
Exploitation of CVE-2025-0466 can be performed through unauthenticated access to vulnerable REST API routes.