Medium severity · published May 15, 2025
CVE-2024-8009
Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure
4.3
CVSS
0.4%
EPSS
No
On KEV
Description
The Sensei LMS WordPress plugin before 4.20.0 disclose all users of the blog including their email address to teachers on the students page
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Sensei LMS ·
before 4.20.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8009
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8009
Exploit
https://wpscan.com/vulnerability/737bb010-b2fa-4bf4-b124-5fbba67cf935/
More from Sensei LMS
5.3
CVE-2025-0466
Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_message Disclosure
5.3
CVE-2024-7786
Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak