Broken Access Control in Sensei LMS WordPress Plugin by Automattic

CVE-2026-112328

What is CVE-2026-112328?

The Sensei LMS WordPress plugin before version 4.26.4 is susceptible to a broken access control vulnerability that enables authenticated users with Teacher roles to manipulate module taxonomy terms across different courses. By exploiting a flaw in the add_new_module_term AJAX handler, these attackers can provide a manipulated course_id, which circumvents proper permissions checks. This vulnerability arises because the handler only verifies a generic nonce and manages permissions through slug prefixing instead of comprehensive checks on course edit rights. As a result, it allows malicious users to alter course content belonging to other teachers or administrators by reusing nonces from their own course settings.

References