TI-2026-76505 Aliases CVE-2026-112328 GHSA-3hm9-hgv5-w9hg

Missing authorization in Sensei LMS lets teachers edit other courses

LOW 23CWE-862Published 2026-10-19 · Updated 2026-10-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control flaw in the add_new_module_term AJAX handler, classified as CWE-862 (Missing Authorization). The handler checks only a generic nonce and does not verify course edit permissions, so it accepts a course_id belonging to someone else. An authenticated user with the Teacher role can assign module taxonomy terms to courses owned by other teachers or administrators by reusing a nonce from their own course. This allows unauthorized modification of course content the attacker does not own.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00171 6th percentileScored 2026-11-07

Fix Fixed Sensei LMS (Automattic): 4.26.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Automattic	Sensei LMS	before 4.26.4	4.26.4	Patch available	CNA

Sensei LMS VendorAutomattic Affected before 4.26.4 Fixed in 4.26.4 Patch available CNA

Remediation

Update Sensei LMS to version 4.26.4, which fixes the issue in versions before 4.26.4. The sources list no vendor advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Sensei LMS (Automattic) Fixed in 4.26.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-10-19
Automattic Sensei LMS 4.26.4
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-76506 Broken access control in Sensei LMS lets users send private messagesPriority LOW 23
Show all 2 records →

Timeline

2026-10-19 Threatist record created from CVE-2026-112328
2026-10-19 Alias added: GHSA-3hm9-hgv5-w9hg
2026-10-20 CISA SSVC decision points changed

References

Patch 1

Release Notes

TI-2023-12700 Improper authentication in WooCommerce Payments WordPress Plugin CVSS 3.1CRITICAL 9.8
TI-2023-03453 Prototype Pollution in automattic/mongoose CVSS 3.1CRITICAL 9.8
TI-2024-06106 Jetpack Boost < 3.4.7 - Admin+ SSRF CVSS 3.1CRITICAL 9.1
TI-2013-01782 WordPress W3 Total Cache Plugin 0.9.2.8 has a Remote PHP Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
TI-2022-02368 Prototype Pollution in automattic/mongoose CVSS 3.1CRITICAL 9.8
TI-2023-02806 Jetpack < 12.1.1 - Author+ Arbitrary File Manipulation via API CVSS 3.1HIGH 8.8

See all 124 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences