Malicious Package

Overview sensei-lms is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Automattic: Sensei LMS IDOR to send message

Hi there, hope you are doing great. So, there is an option to send message to teacher privately by student on Sensei LMS. Each message sent by student will have different ID, Student1 cannot access or send message to the message from Student2 which is meant to be private with teacher Similarly...

Automattic: Unauthenticated Private Messages DIsclosure via wordpress Rest API

Vulnearble Plugin: Senei LMS Hi there, Hope you are doing well, So, i noticed that their is an option to contact teacher on Sensei LMS which is meant to private. By default, other user can't see the question I asked to the teacher. But using the /wp-json/wp/v2/sensei-messages/ where numeric ID ca...