CVE-2026-112329
Received Received - Intake

Sensei LMS Broken Access Control in Message Handling

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112329
EUVD
EUVD-2026-104388

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Automattic Sensei LMS 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Sensei LMS WordPress plugin before version 4.26.4 has a broken access control flaw in the legacy save_new_message handler. This handler only checks a generic nonce without verifying if the user is enrolled in the course or restricting the post_id to valid post types. Authenticated attackers, even low-privilege users like Subscribers, can exploit this to create private messages for any course, lesson, or quiz author by supplying an arbitrary post_id.

Detection Guidance

To detect this vulnerability, check if your Sensei LMS plugin version is before 4.26.4. Inspect WordPress admin panels for unauthorized private messages created by low-privileged users. Review server logs for POST requests to /wp-admin/admin-post.php with save_new_message action and arbitrary post_id parameters.

Impact Analysis

An attacker could send unauthorized private messages to course authors, potentially impersonating legitimate users or sharing sensitive information. This could disrupt communication, lead to misinformation, or expose confidential data if messages contain sensitive content.

Compliance Impact

This vulnerability could lead to unauthorized access to user data or communication channels, potentially violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Organizations using this plugin may face compliance risks if user data is exposed or mishandled.

Mitigation Strategies

Update the Sensei LMS WordPress plugin to version 4.26.4 or later to address the broken access control vulnerability in the legacy save_new_message handler.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112329. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart