CVE-2026-112328: Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-27
Weakness: CWE-862

Description

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

Affected products

Sensei LMS: before 4.26.4 — fixed in 4.26.4

How to fix

Upgrade to a fixed version: Sensei LMS 4.26.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-112328 or the next vulnerability affects your stack