Broken Access Control Vulnerability in Sensei LMS by Sensei

CVE-2026-112329

What is CVE-2026-112329?

The Sensei LMS WordPress plugin prior to version 4.26.4 is susceptible to a broken access control flaw, specifically in the legacy save_new_message handler associated with the init action. This vulnerability permits authenticated attackers, even those with minimal privileges like Subscribers, to bypass course enrollment verification. By utilizing a generic nonce, the vulnerability enables these attackers to supply arbitrary post IDs linked to any course, lesson, or quiz. Consequently, this allows the creation of private messages addressed to the authors of those posts, which can lead to unintended disclosures or unauthorized interactions within the platform. It is crucial for users to update to version 4.26.4 or newer to secure their systems against this potential exploitation.

References