CVE-2026-112329— Sensei LMS 4.26.4 Broken Access Control via save_new_message
Quick assessment
Affected
Automattic Sensei LMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Sensei LMS WordPress 插件在 4.26.4 版本之前存在访问控制缺陷：其遗留的 处理函数挂载在 动作上，仅验证通用 nonce，却未检查课程注册状态，也未将 限制为有效的文章类型。已认证的攻击者（包括无特权的订阅者）可针对任意课程、课程单元或测验提供任意 ，从而向该文章作者创建一条私密消息，绕过新版 REST 控制器所实施的注册检查。
Possible ATT&CK Techniques 2 AI
T1133 · External Remote Services T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Automattic | Sensei LMS | < 4.26.4 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-112329
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sensei LMS 4.26.4 Broken Access Control via save_new_message
Source: CVE Program / CVE List V5
Vulnerability Description
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Automattic | Sensei LMS | 0 ~ 4.26.4 | - |
|
II. Public POCs for CVE-2026-112329
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-112329
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-112329 (1)
IV. Related Vulnerabilities
Same product: Sensei LMS
-
CVE-2026-112328
Sensei LMS 4.26.4 Broken Access Control via add_new_module_t -
CVE-2024-8009
Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosur -
CVE-2025-22740
WordPress Sensei LMS plugin <= 4.24.4 - Broken Access Contro -
CVE-2025-0466
Sensei LMS < 4.24.4 - Unauthenticated sensei_email/sensei_me -
CVE-2024-7786
Sensei LMS < 4.24.2 - Unauthenticated Email Template Leak
Same vendor: Automattic
-
CVE-2026-112328
Sensei LMS 4.26.4 Broken Access Control via add_new_module_t -
CVE-2026-40808
WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access C -
CVE-2026-106608
WordPress WooCommerce plugin 9.8.0-11.1.2 - Shop Manager+ Pr -
CVE-2026-106602
WordPress Jetpack plugin <= 16.2 - Broken Authentication vul -
CVE-2026-106601
WordPress Jetpack plugin <= 16.2 - Broken Authentication vul
Same weakness: CWE-862
-
CVE-2026-112778
Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Re -
CVE-2025-7043
Refresh Token Misuse via Validation Flaw in Multiple WSO2 Pr -
CVE-2026-111058
Mercury: Unauthenticated Remote Code Execution via /api/kern -
CVE-2026-111046
FOSSBilling: Low-privileged staff can read and modify config -
CVE-2026-107566
Missing Authorization in hMailServer
V. Comments for CVE-2026-112329
No comments yet