CVE-2025-22740: Sensei LMS Auth Bypass Vulnerability

CVE-2025-22740 Overview

CVE-2025-22740 is a missing authorization vulnerability in the Automattic Sensei LMS WordPress plugin. The flaw stems from incorrectly configured access control security levels [CWE-862] and affects Sensei LMS versions up to and including 4.24.4. An unauthenticated attacker can send network requests to protected functionality without meeting the intended authorization requirements. Successful exploitation results in limited confidentiality impact, with no integrity or availability consequences based on the published CVSS vector. The EPSS score is 0.263% at the 17.955 percentile, indicating low probability of near-term exploitation.

Critical Impact
Unauthenticated network attackers can access functionality that should require authorization, leading to disclosure of restricted learning management data on affected WordPress sites.

Affected Products

Automattic Sensei LMS plugin (sensei-lms) for WordPress
All versions from initial release through 4.24.4
WordPress sites running the affected plugin versions

Discovery Timeline

2025-03-27 - CVE-2025-22740 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-22740

Vulnerability Analysis

The vulnerability is a broken access control weakness classified under [CWE-862] Missing Authorization. Sensei LMS exposes functionality that fails to verify whether the requesting user holds the required capability or role. Because the flaw is reachable over the network without authentication and without user interaction, an attacker can invoke the impacted endpoints directly. The impact is limited to confidentiality, meaning the exposed operations disclose data rather than alter site content or disrupt service.

Sensei LMS is used to deliver online courses, quizzes, and learner data on WordPress sites. Missing authorization on plugin endpoints can therefore reveal information tied to course structures, learner progress, or other restricted resources managed by the plugin.

Root Cause

The root cause is an authorization check that is either absent or configured at an insufficient security level on one or more Sensei LMS request handlers. WordPress plugins commonly enforce access with current_user_can() capability checks or nonce validation. When these controls are missing on AJAX actions, REST routes, or admin-post handlers, any unauthenticated caller can reach the underlying logic.

Attack Vector

Exploitation requires only network access to the target WordPress site. The attacker sends crafted HTTP requests to the vulnerable Sensei LMS endpoint and receives data that should be gated behind authentication or a higher-privileged role. No credentials, tokens, or user interaction are required. See the Patchstack Vulnerability Report for advisory details.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-22740

Indicators of Compromise

Unauthenticated HTTP requests to Sensei LMS AJAX or REST endpoints from unfamiliar IP addresses
Anomalous response sizes returned from plugin endpoints to unauthenticated sessions
Requests to /wp-admin/admin-ajax.php referencing Sensei LMS actions without a valid logged-in cookie

Detection Strategies

Inventory WordPress installations and identify sites running Sensei LMS at or below version 4.24.4
Review web server access logs for repeated calls to Sensei LMS endpoints originating from a single source without prior authentication
Correlate WordPress audit logs with plugin activity to surface access patterns that bypass expected user roles

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and admin-ajax handler for the plugin namespace
Alert on high-volume enumeration of Sensei LMS routes from unauthenticated sessions
Track new user registrations, course access, and quiz result queries for statistical anomalies

How to Mitigate CVE-2025-22740

Immediate Actions Required

Update Sensei LMS to a version later than 4.24.4 as soon as a fixed release is available from Automattic
Restrict access to /wp-admin/admin-ajax.php and the WordPress REST API at the web application firewall where feasible
Audit user roles and remove unused Sensei LMS accounts to reduce data exposure

Patch Information

Refer to the Patchstack Vulnerability Report for the authoritative vendor patch status. Administrators should apply the vendor-supplied Sensei LMS update through the WordPress plugin manager once released and confirm the installed version exceeds 4.24.4.

Workarounds

Deploy a virtual patch or WAF rule that blocks unauthenticated access to the vulnerable Sensei LMS request handlers
Temporarily deactivate the Sensei LMS plugin on production sites that cannot be updated immediately
Enforce IP allow-listing for administrative and course-management endpoints until the patched version is deployed

bash

# Example: WordPress CLI check for affected Sensei LMS versions
wp plugin get sensei-lms --field=version
wp plugin update sensei-lms