漏洞描述
WordPress Sensei LMS plugin before 4.5.0 is susceptible to information disclosure. The plugin does not have proper permissions set in a REST endpoint, which can allow an attacker to access private messages.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
wpscan.comhttps://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426↗hackerone.comhttps://hackerone.com/reports/1590237↗wordpress.orghttps://wordpress.org/plugins/sensei-lms/advanced/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2022-2034↗github.comhttps://github.com/ARPSyndicate/kenzer-templates↗