Automattic Sensei LMS Plugin up to 4.26.3 on WordPress Add New Module Term AJAX wp_set_object_terms course_id access control

Summaryinfo

A vulnerability, which was classified as problematic, was found in Automattic Sensei LMS Plugin up to 4.26.3. The impacted element is the function wp_set_object_terms of the component Add New Module Term AJAX Handler. Such manipulation of the argument course_id leads to access control. This vulnerability is documented as CVE-2026-112328. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in Automattic Sensei LMS Plugin up to 4.26.3. It has been rated as problematic. Affected by this issue is the function wp_set_object_terms of the component Add New Module Term AJAX Handler. The manipulation of the argument course_id with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is integrity. CVE summarizes:

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.

The advisory is shared for download at senseilms.com. This vulnerability is handled as CVE-2026-112328 since 10/19/2026. The exploitation is known to be easy. The attack may be launched remotely. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 4.26.4 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• Automattic

Name

• Sensei LMS Plugin

Version

• 4.26.0
• 4.26.1
• 4.26.2
• 4.26.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion