Vulnerability · Published Oct 19, 2026 · Assigned by VulnCheck

CVE-2026-112328Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX

Medium 4.3

In plain English

A medium-severity missing authorization in Sensei LMS from Automattic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

Affected products (as reported)

Vendor	Product	Versions
Automattic	Sensei LMS	0 – before 4.26.4

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

Release Notes release-notes, patch
VulnCheck Advisory: Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX third-party-advisory