Live › vulnerability › CVE-2026-112328
Go to dashboardThe Sensei LMS plugin before 4.26.4 has an AJAX handler that does not check course ownership before assigning module terms. An authenticated Teacher can change content of courses they do not own by supplying another course's ID with a nonce taken from their own course.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Sensei LMS WordPress plugin before 4.26.4 that have users with the Teacher role. Exposure requires a logged-in Teacher account, so sites with no Teacher accounts are less exposed. The sources do not say whether other roles are affected.
No product ranges from the sources yet.
4.26.4 are in scope.unknown whether the sources name a specific file to inspect).4.26.4 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
This page as .md · .json · in your agent: get_signal("CVE-2026-112328")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.