CVE-2026-112329 Details
Description
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.
A broken access control vulnerability has been identified in the Sensei LMS WordPress plugin, affecting versions prior to 4.26.4. The vulnerability resides in the legacy save_new_message handler, which is linked to the init action. This handler only validates a generic nonce and fails to verify course enrollment or restrict post_id to valid post types. As a result, authenticated attackers, including unprivileged Subscribers, can manipulate the post_id to create private messages for any course, lesson, or quiz, addressed to the respective post's author. This exploitation bypasses the enrollment checks implemented by the newer REST send-message controller.
Users are advised to update the Sensei LMS WordPress plugin to version 4.26.4 or later, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://senseilms.com/release-notes/ | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/sensei-lms-broken-access-control-via-save-new-message | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Sensei LMS | < 4.26.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |