CVE-2026-112328: automattic sensei lms Missing Authorization

Vulnerability summary

CVE-2026-112328 is a medium (CVSS 5.3) Missing Authorization vulnerability in automattic sensei lms. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.5% of scored vulnerabilities.

Timeline

1. 19-10-2026
   PublishedVulnerability first disclosed.
2. 19-10-2026
   Last modifiedVulnerability information updated.

Description

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

• CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.