CVE-2022-2034
Published: 29 August 2022
Summary
CVE-2022-2034 is a medium-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Automattic Sensei Lms. Its CVSS base score is 5.3 (Medium).
Operationally, ranked in the top 2.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is an authorization flaw in the Sensei LMS WordPress plugin prior to version 4.5.0. One of the plugin's REST endpoints lacks proper permission checks, enabling access to private messages intended for teachers. The issue is tracked as CWE-639 and carries a CVSS 3.1 score of 5.3.
Unauthenticated attackers with network access can exploit the endpoint to retrieve the contents of those private messages without any authentication or user interaction. The attack requires no privileges and results only in limited confidentiality exposure.
EPSS for the CVE rose from lower values after disclosure to a peak of 0.5137 on 2025-12-11 before receding to the current 0.3375, indicating that exploitation interest increased well after the initial publication and that the issue merits renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-34338
Vulnerability details
The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.