CVE-2026-112328
Received Received - Intake

Broken Access Control in Sensei LMS WordPress Plugin

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112328
EUVD
EUVD-2026-104386

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Automattic Sensei LMS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a broken access control vulnerability in the Sensei LMS WordPress plugin before version 4.26.4. It allows authenticated users with the Teacher role to assign module taxonomy terms to courses they do not own by exploiting a flawed AJAX handler. The handler only checks a generic nonce and the manage_options capability for slug prefixing, not actual course edit permissions.

Detection Guidance

To detect this vulnerability, check if your Sensei LMS plugin version is below 4.26.4. Inspect AJAX requests in browser developer tools for the add_new_module_term handler. Look for requests with course_id parameters from non-admin users. Review server logs for unauthorized term assignments to courses.

Impact Analysis

An attacker with Teacher access could modify course content, reassign modules, or alter course structure without permission. This could disrupt learning activities, misrepresent course materials, or cause confusion among students and administrators. The impact depends on the attacker's goals and the courses targeted.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modification of course content. Unauthorized changes to educational or training materials may violate data integrity requirements under these regulations, particularly if the content includes sensitive personal or health information. The flaw enables attackers to alter course data without proper authorization, which could lead to non-compliance with access control and integrity provisions.

Mitigation Strategies

Update the Sensei LMS WordPress plugin to version 4.26.4 or later to address the broken access control vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112328. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart