CVE-2026-112329: Sensei LMS 4.26.4 Broken Access Control via save_new_message
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy savenewmessage handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting postid to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary postid for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user, including a Subscriber, can exploit it if they can submit a request to the legacy save_new_message handler with a valid generic nonce.
What access does exploitation provide?
An attacker can create a private message to the author of an arbitrary course, lesson, or quiz by supplying that content's post_id. The issue bypasses the enrollment checks used by the newer REST messaging controller.
Are unenrolled users affected?
Yes. The vulnerable legacy handler does not verify that the sender is enrolled in the specified course and does not restrict post_id to valid post types.
How can I determine whether my site is affected?
Sites using a Sensei LMS version before 4.26.4 are affected. The vulnerable path is the legacy save_new_message handler registered on the WordPress init action.