CVE-2026-112329: Missing Authorization in Automattic Sensei LMS

CVE-2026-112329 is a broken access control vulnerability in the legacy save_new_message handler of the Sensei LMS WordPress plugin prior to version 4.26.4. The handler is hooked on the init action and validates only a generic nonce, failing to verify if the authenticated user is enrolled in the course or if the post_id corresponds to a valid course, lesson, or quiz post type. As a result, authenticated attackers with minimal privileges (e.g., Subscribers) can specify arbitrary post_ids to create private messages addressed to the authors of those posts, bypassing enrollment restrictions enforced by the newer REST send-message controller.

Authenticated users with low privileges can send private messages to authors of any course, lesson, or quiz post by exploiting the broken access control in the legacy message handler. This bypasses intended enrollment checks, potentially allowing unauthorized communication with course content authors. There is no indication of privilege escalation beyond message creation or other impacts such as data disclosure or code execution.

Upgrade Sensei LMS to version 4.26.4 or later, where this broken access control vulnerability has been fixed. The legacy save_new_message handler has been replaced or secured to properly verify course enrollment and restrict post_id to valid post types. No other mitigations are indicated.