Sensei LMS < 4.5.2 - Arbitrary Private Message Sending via IDOR

An authenticated user can send a private message to an arbitrary conversation by manipulating the conversation identifier in the request. The plugin did not verify that the sender is either the teacher or the original participant of that conversation, enabling an Insecure Direct Object Reference (IDOR) attack. The attacker only needs to be logged into WordPress and know or guess the conversation ID; they cannot read existing messages, only inject new ones.

The patch provided only bumps the version number and updates changelog entries; no source code changes to the private messaging logic are included in this diff. The advisory states that the private message sender check was missing in versions before 4.5.2, but the exact file or function responsible is not visible in this patch.

The supplied patch only updates version strings and changelog entries; it does not contain any code diff that shows how the sender authorization was added. Based on the advisory, the fix in version 4.5.2 must have introduced a check that ensures the current user is either the teacher or the original sender of the conversation before allowing a message to be sent. Without the actual code change visible, the precise mechanism cannot be confirmed from this bundle alone.