CVE-2026-112329: Sensei LMS 4.26.4 Broken Access Control via save_new_message

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-27
Weakness: CWE-862

Description

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.

Affected products

Sensei LMS: before 4.26.4 — fixed in 4.26.4

How to fix

Upgrade to a fixed version: Sensei LMS 4.26.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-112329 or the next vulnerability affects your stack