CVE-2026-112328— Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
Quick assessment
Affected
Automattic Sensei LMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 4.26.4 版本之前，Sensei LMS WordPress 插件的 AJAX 处理器中存在访问控制失效漏洞。该漏洞允许拥有教师（Teacher）角色的已认证攻击者，通过构造恶意的 参数，将模块分类法术语（taxonomy terms）分配给任意课程。其根本原因在于：该处理器仅验证了通用 nonce（一次性令牌），且仅针对 slug 前缀检查了 权限，而未验证用户是否具备编辑目标课程的权限。 攻击者可利用从自身课程元框（metabox）中获取的 nonce，调用 函数，对属于其他教师或管理员的课程执行操作，
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Automattic | Sensei LMS | < 4.26.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112328
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
Source: CVE Program / CVE List V5
Vulnerability Description
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Automattic | Sensei LMS | 0 ~ 4.26.4 | - |
|
II. Public POCs for CVE-2026-112328
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112328
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-112328 (1)
IV. Related Vulnerabilities
Same product: Sensei LMS
-
CVE-2026-112329
Sensei LMS 4.26.4 Broken Access Control via save_new_message -
CVE-2024-8009
Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosur -
CVE-2025-22740
WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Contro -
CVE-2025-0466
Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_me -
CVE-2024-7786
Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak
Same vendor: Automattic
-
CVE-2026-112329
Sensei LMS 4.26.4 Broken Access Control via save_new_message -
CVE-2026-40808
WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access C -
CVE-2026-106608
WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Pr -
CVE-2026-106602
WordPress Jetpack plugin <= 16.2 - Broken Authentication vul -
CVE-2026-106601
WordPress Jetpack plugin <= 16.2 - Broken Authentication vul
Same weakness: CWE-862
-
CVE-2026-113660
ApostropheCMS: Authenticated Object-Level Authorization Bypa -
CVE-2026-113649
ApostropheCMS: Import API bypasses publication roles for pro -
CVE-2026-112957
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses -
CVE-2026-113677
Froxlor 0.10.0 before 2.3.15 Missing Authorization via SubDo -
CVE-2026-113612
SparkyFitness before 0.17.0 Missing Authorization via food-v
V. Comments for CVE-2026-112328
No comments yet