CVE-2026-112328: Missing Authorization in Automattic Sensei LMS

The Sensei LMS WordPress plugin versions prior to 4.26.4 contain a broken access control vulnerability in the add_new_module_term AJAX handler. Authenticated users with the Teacher role can supply a crafted course_id parameter to assign module taxonomy terms to arbitrary courses. The handler only validates a generic nonce and checks manage_options for slug prefixing, but fails to verify whether the user has edit permissions on the specified course. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms on courses owned by other teachers or administrators, allowing unauthorized modification of course content they do not own.

An attacker with Teacher role privileges can modify course content of other users, including courses owned by other teachers or administrators. This unauthorized modification could affect the integrity and management of course materials, potentially disrupting course delivery or content accuracy. The vulnerability does not require user interaction beyond authentication and has a medium severity score (CVSS 5.3).

A fix is available in Sensei LMS version 4.26.4. Users should upgrade to version 4.26.4 or later to remediate this vulnerability. Until patched, restrict Teacher role permissions or monitor for suspicious activity related to course taxonomy term assignments.