CVE-2026-112328 Details
Description
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
A broken access control vulnerability has been identified in the Sensei LMS WordPress plugin, affecting versions prior to 4.26.4. The issue resides in the add_new_module_term AJAX handler, where authenticated users with Teacher roles can exploit the vulnerability to assign module taxonomy terms to any course. This is achieved by sending a manipulated course_id, as the handler only verifies a generic nonce and relies on manage_options for slug prefixing without properly checking course edit permissions. Consequently, attackers can use a nonce from their own course metabox to modify courses belonging to other teachers or administrators, unauthorizedly altering course content they do not own.
Users are advised to update the Sensei LMS WordPress plugin to version 4.26.4 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://senseilms.com/release-notes/ | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/sensei-lms-broken-access-control-via-add-new-module-term-ajax | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sensei LMS | < 4.26.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |