Sensei LMS – Online Courses, Quizzes, & Learning Security & Risk Analysis

The "sensei-lms" v4.25.2 plugin exhibits a mixed security posture. On the positive side, it demonstrates good practices in SQL query sanitization (85% prepared statements) and output escaping (93% properly escaped), with a robust number of capability checks (140) and nonce checks (65) suggesting a strong awareness of securing core functionalities. The absence of critical or high-severity taint flows and known unpatched CVEs is also a significant strength.

However, several concerns warrant attention. The plugin presents a substantial attack surface with 39 AJAX handlers, a significant portion of which (10) lack proper authentication checks. This directly translates to potential unauthorized access or execution of actions by unauthenticated users. Furthermore, eight flows with unsanitized paths identified in the taint analysis, while not flagged as critical or high, represent a potential avenue for path traversal or information disclosure vulnerabilities, especially when combined with the unprotected AJAX endpoints.

The plugin's vulnerability history, while currently clear of unpatched issues, reveals a pattern of medium-severity vulnerabilities including missing authorization, exposure of sensitive information, and cross-site scripting. This historical trend, coupled with the static analysis findings of unprotected AJAX endpoints, indicates a recurring need for diligent security auditing and patching, particularly concerning input validation and authorization checks. The presence of bundled libraries like TinyMCE, jQuery, and Select2, while common, necessitates vigilance regarding their own security vulnerabilities and update status.