Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Automattic Sensei LMS 4.26.4 Clear all filters
TI-2026-76506 CVE-2026-112329 · GHSA-32x8-68x9-4hfv

Broken access control in Sensei LMS lets users send private messages

Priority LOW 23

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00196 Published 2026-10-19 Fixed in 4.26.4 CWE-862
TI-2026-76505 CVE-2026-112328 · GHSA-3hm9-hgv5-w9hg

Missing authorization in Sensei LMS lets teachers edit other courses

Priority LOW 23

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arb…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00171 Published 2026-10-19 Fixed in 4.26.4 CWE-862