CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
What the vulnerability does
Missing Authorization vulnerability in Automattic Sensei LMS, Automattic Sensei Pro (WC Paid Courses).This issue affects Sensei LMS: from n/a through 4.23.1; Sensei Pro (WC Paid Courses): from n/a through 4.23.1.1.23.1.
Explanation of Vulnerability in Simple Terms
Sensei LMS through version 4.23.1 lacks proper authorization checks, allowing unauthenticated attackers to disrupt the service. The vulnerability does not expose sensitive data or allow modification of content, but can make the platform unavailable to legitimate users. Update to a version newer than 4.23.1 to resolve this issue.
What an attacker can do
Make the Sensei LMS platform unavailable to legitimate users without needing to log in.
Potential impact on your site
Your LMS may become unavailable to students and instructors due to denial-of-service attacks.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
