CVE-2026-112328 in Sensei LMS Plugin
Summary
by MITRE • 10/19/2026
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/19/2026
The Sensei LMS WordPress plugin version 4.26.3 and earlier contains a critical broken access control vulnerability within its AJAX handler for adding new module terms to courses. This flaw stems from an insufficient verification mechanism that fails to enforce proper authorization checks on the specific resource being modified. While the application correctly implements nonce validation to prevent Cross-Site Request Forgery attacks, it neglects to verify whether the authenticated user possesses the necessary permissions to edit or manage the target course identified by the supplied course_id parameter. The existing logic only validates a generic nonce and performs a rudimentary check on the slug prefix against the manage_options capability, which is insufficient for ensuring that the actor has ownership or administrative rights over the specific post object being targeted.
This architectural oversight allows authenticated users with the Teacher role to exploit the functionality by supplying a crafted course_id corresponding to courses owned by other teachers or administrators. By reusing a valid nonce obtained from their own course metabox, an attacker can invoke the wp_set_object_terms function against arbitrary course objects outside of their authorized scope. This capability enables the unauthorized modification of course content structure and taxonomy assignments for resources that the attacker does not own. The vulnerability effectively bypasses WordPress's default role-based access control mechanisms by exploiting a logic error in the plugin's custom AJAX endpoint rather than breaking cryptographic or session management controls.
The operational impact of this vulnerability is significant, as it allows attackers to disrupt course structures, inject unwanted module taxonomy terms into other users' courses, and potentially escalate privileges if those taxonomies influence content visibility or access rules. This aligns with CWE-284 Improper Access Control, specifically the failure to verify authorization for specific resources after initial authentication has occurred. From a threat modeling perspective using the MITRE ATT&CK framework, this behavior corresponds to T1078 Valid Accounts and T1530 Data from Information Repositories if the modification leads to data exposure or integrity compromise through structural manipulation of course materials.
Mitigation strategies should prioritize immediate upgrading to Sensei LMS version 4.26.4 or later, where these access control checks have been rectified. For environments where patching is not immediately feasible, administrators can mitigate risk by restricting AJAX endpoint access via web application firewall rules that validate the user's capability against the specific post ID before allowing the request to proceed. Additionally, implementing stricter server-side validation in custom plugins to ensure that any operation involving wp_set_object_terms verifies both nonce validity and explicit ownership or edit permissions for the target course_id is essential to prevent similar logic flaws in future development cycles.