{"id":"CVE-2026-112329","title":"Sensei LMS 4.26.4 Broken Access Control via save_new_message","summary":"The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or re…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvssSource":"cna","cwe":["CWE-862"],"vendor":"Automattic","product":"Sensei LMS","affected":["sensei_lms < 4.26.4"],"published":"2026-10-19","updated":"2026-10-19","sourceUpdated":"2026-10-19T14:45:24.844Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-112329","references":[{"url":"https://senseilms.com/release-notes/","label":"Release Notes"},{"url":"https://www.vulncheck.com/advisories/sensei-lms-broken-access-control-via-save-new-message","label":"VulnCheck Advisory: Sensei LMS 4.26.4 Broken Access Control via save_new_message"}],"tags":["cve.org"],"ingestedAt":"2026-10-19T15:31:18.962Z","slug":"CVE-2026-112329","body":"## Overview\n\nThe Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.\n\n## Affected\n\n- `sensei_lms < 4.26.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}