---
id: "CVE-2026-112328"
kind: "vulnerability"
aliases: ["CVE-2026-112328"]
title: "Sensei LMS WordPress plugin lets teachers modify other teachers' courses"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["lms", "package", "self-hosted", "sensei-lms", "wordpress"]
not_affected_if: ["no-teacher-accounts", "plugin-updated"]
published_at: "2026-10-19T15:17:06+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-25T04:25:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112328", "first_seen_at": "2026-10-23T21:57:18+00:00"}]
---

# Sensei LMS WordPress plugin lets teachers modify other teachers' courses

The Sensei LMS plugin before 4.26.4 has an AJAX handler that does not check course ownership before assigning module terms. An authenticated Teacher can change content of courses they do not own by supplying another course's ID with a nonce taken from their own course.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Sensei LMS plugin version in the WordPress admin plugins list; versions below `4.26.4` are in scope.
- Confirm a Teacher role account exists on the site (`unknown` whether the sources name a specific file to inspect).

## Fix

- Update the Sensei LMS plugin to `4.26.4` or later.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112328

## From the sources

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_