CVE-2026-112328: Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the addnewmoduleterm AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted courseid, since the handler validates only a generic nonce and checks manageoptions solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wpsetobjectterms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sensei LMSto a version that resolves this vulnerability.Fixed in 4.26.4
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with the Teacher role can exploit it. The attacker needs a nonce obtained from the module metabox of a course they can access.
What access is required to exploit it?
The attacker must be able to send an authenticated AJAX request and provide a crafted course_id for a course owned by another teacher or an administrator. No interaction from the targeted course owner is required.
What can an attacker change?
They can assign module taxonomy terms to arbitrary courses, including courses they do not own. This enables unauthorized modification of course content.
Which versions are affected?
Sensei LMS versions before 4.26.4 are affected.