CVE-2024-8009
📋 TL;DR
The Sensei LMS WordPress plugin before version 4.20.0 exposes all user email addresses to teachers on the students page. This information disclosure vulnerability affects WordPress sites using the vulnerable plugin version, potentially exposing student and user privacy.
💻 Affected Systems
- Sensei LMS WordPress plugin
📦 What is this software?
Sensei Lms by Automattic
⚠️ Risk & Real-World Impact
Worst Case
All user email addresses are exposed to teachers, potentially enabling targeted phishing campaigns, spam, or harassment against students and other users.
Likely Case
Teachers gain unauthorized access to student email addresses, violating privacy expectations and potentially GDPR/regulatory compliance.
If Mitigated
Limited exposure if only trusted teachers have access, but still violates privacy principles and data protection requirements.
🎯 Exploit Status
Exploitation requires teacher-level access to view the students page where the disclosure occurs.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.20.0
Vendor Advisory: https://wpscan.com/vulnerability/737bb010-b2fa-4bf4-b124-5fbba67cf935/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Sensei LMS plugin. 4. Click 'Update Now' if available, or manually update to version 4.20.0 or later.
🔧 Temporary Workarounds
Restrict Teacher Access
allTemporarily remove teacher access to students page until patched
Use WordPress role editor plugin to modify teacher capabilities
🧯 If You Can't Patch
- Disable Sensei LMS plugin temporarily
- Implement additional access controls to restrict teacher access to sensitive areas
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin > Plugins > Sensei LMS version numberCheck Version:
wp plugin list --name=sensei-lms --field=versionVerify Fix Applied:
Verify plugin version is 4.20.0 or higher and test teacher access to students page📡 Detection & Monitoring
Log Indicators:
- Unusual teacher account access patterns to students page
- Multiple user data queries from teacher accounts
Network Indicators:
- HTTP requests to /wp-admin/admin.php?page=sensei_learners
SIEM Query:
source="wordpress" AND uri_path="/wp-admin/admin.php" AND query="page=sensei_learners"