Live › vulnerability › CVE-2026-112329
Go to dashboardThe Sensei LMS WordPress plugin before 4.26.4 has a legacy message handler that checks only a generic nonce and skips course enrollment checks. An logged-in subscriber can send a private message to the author of any course, lesson or quiz they are not enrolled in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Sensei LMS before where users can hold accounts with the Subscriber role or higher, which is the usual case for course sites that allow registration. Sites with no open registration and no logged-in users have less exposure. The sources do not say whether managed WordPress hosts ship the fix automatically.
4.26.4No product ranges from the sources yet.
wp plugin get sensei-lms --field=versionsave_new_message handler exists in the plugin code (unknown whether the sources name a file path)4.26.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.
This page as .md · .json · in your agent: get_signal("CVE-2026-112329")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.