This vulnerability in Sensei LMS arises from missing authorization checks due to incorrectly configured access control. It affects all versions up to 4.24.4. The issue could allow an attacker to access functionality or data without proper permissions. The CVSS 3.1 base score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality but not integrity or availability. No vendor advisory or patch links are currently available, and no exploits have been reported in the wild.

The vulnerability allows unauthorized access to certain features or data within Sensei LMS, potentially leading to limited confidentiality loss. There is no impact on integrity or availability according to the CVSS vector. Since no exploits are known in the wild, the immediate risk appears limited but could increase if exploitation techniques emerge.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor Automattic's communications for updates. Applying principle of least privilege and reviewing access controls within Sensei LMS configurations may help reduce exposure.