CVE-2026-112328
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions.
Risk Assessment
Teachers can modify course content owned by other teachers or administrators, compromising data integrity and potentially altering training materials without authorization.
Recommendation
Update the Sensei LMS plugin to version 4.26.4 or later. Until patched, consider restricting Teacher role capabilities.
Other vulnerabilities in Sensei LMS WordPress plugin
Original NVD description (English source)
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS