{"id":"CVE-2026-112328","kind":"vulnerability","aliases":["CVE-2026-112328"],"related":[],"title":"Sensei LMS WordPress plugin lets teachers modify other teachers' courses","description":"The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.","summary":"The Sensei LMS plugin before 4.26.4 has an AJAX handler that does not check course ownership before assigning module terms. An authenticated Teacher can change content of courses they do not own by supplying another course's ID with a nonce taken from their own course.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["lms","package","self-hosted","sensei-lms","wordpress"],"not_affected_if":["no-teacher-accounts","plugin-updated"],"how_to_check":"- Check the installed Sensei LMS plugin version in the WordPress admin plugins list; versions below `4.26.4` are in scope.\n- Confirm a Teacher role account exists on the site (`unknown` whether the sources name a specific file to inspect).","fix":"- Update the Sensei LMS plugin to `4.26.4` or later.","status":"open","published_at":"2026-10-19T15:17:06+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-25T04:25:06+00:00","updated_at":"2026-10-25T04:25:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:25:06Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Sensei LMS plugin to `4.26.4` or later.","reach":"internet","title":"Sensei LMS WordPress plugin lets teachers modify other teachers' courses","impact":"medium","summary":"The Sensei LMS plugin before 4.26.4 has an AJAX handler that does not check course ownership before assigning module terms. An authenticated Teacher can change content of courses they do not own by supplying another course's ID with a nonce taken from their own course.","category":"package","nicknames":[],"who_cares":["wordpress","sensei-lms","lms","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Teacher can alter other teachers' course content","analyst_note":"","how_to_check":"- Check the installed Sensei LMS plugin version in the WordPress admin plugins list; versions below `4.26.4` are in scope.\n- Confirm a Teacher role account exists on the site (`unknown` whether the sources name a specific file to inspect).","needs_analyst":false,"not_affected_if":["no-teacher-accounts","plugin-updated"],"who_is_affected":"Sites running the Sensei LMS WordPress plugin before 4.26.4 that have users with the Teacher role. Exposure requires a logged-in Teacher account, so sites with no Teacher accounts are less exposed. The sources do not say whether other roles are affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000601,"input_tokens":3423,"output_tokens":518,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112328':13A,16A '-2026':12A,15A '4.26.4':31B,78C 'access':82C 'add':87C 'administr':160C 'ajax':34B,91C 'allow':94C 'anoth':60B 'arbitrari':106C 'assign':43B,101C 'attack':99C,136C 'authent':47B,95C 'broken':81C 'call':148C 'chang':50B 'check':39B,123C 'contain':79C 'content':51B,166C 'control':83C 'cours':10A,40B,53B,61B,71B,107C,112C,133C,145C,154C,165C 'craft':111C 'cve':11A,14A 'edit':134C 'enabl':161C 'generic':120C 'handler':35B,92C,116C 'host':21B 'id':63B,113C 'let':5A 'lms':2A,17B,24B,28B,74C 'manag':124C 'metabox':146C 'modif':163C 'modifi':7A 'modul':44B,89C,102C 'new':88C 'nonc':66B,121C,140C 'object':151C 'obtain':141C 'option':125C 'own':155C 'ownership':41B 'packag':18B 'permiss':135C 'plugin':4A,29B,76C 'prefix':129C 'rather':130C 'reus':138C 'role':98C 'self':20B 'self-host':19B 'sensei':1A,23B,27B,73C 'sensei-lm':22B 'set':150C 'sinc':114C 'slug':128C 'sole':126C 'suppli':59B,109C 'taken':67B 'taxonomi':103C 'teacher':6A,9A,48B,97C,158C 'teacher-rol':96C 'term':45B,90C,104C,152C 'unauthor':162C 'valid':117C 'verifi':132C 'vulner':84C 'wordpress':3A,25B,75C 'wp':149C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Sensei LMS WordPress plugin before 4.26.4 that have users with the Teacher role. Exposure requires a logged-in Teacher account, so sites with no Teacher accounts are less exposed. The sources do not say whether other roles are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T15:17:06+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112328","severity":null,"published_at":"2026-10-19T15:17:06+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}