Sensei LMS < 4.5.0 - Unauthenticated Private Messages Disclosure via Rest API

An unauthenticated attacker can send a crafted REST API request to the affected endpoint, which lacks proper permission checks. Because the endpoint does not verify the user's identity or role, the attacker can retrieve private messages intended for teachers. The attack requires no authentication, no special network position, and no prior interaction with the system.

The patch only updates the version number in `package-lock.json` from 4.4.3 to 4.5.0. The actual code fix for the REST endpoint permission issue is not visible in this diff; the advisory indicates the fix was applied in version 4.5.0 of the Sensei LMS WordPress plugin.

The patch shown only increments the plugin version from 4.4.3 to 4.5.0 in `package-lock.json`. The actual security fix—adding proper permission checks to the REST endpoint—is not included in this diff but was shipped as part of the 4.5.0 release. By enforcing authorization on the endpoint, the fix ensures that only authenticated users with the correct role can access private teacher messages.