---
id: CVE-2026-112329
title: Sensei LMS 4.26.4 Broken Access Control via save_new_message
summary: >-
  The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control
  vulnerability in the legacy save_new_message handler hooked on the init
  action, which validates only a generic nonce without verifying course
  enrollment or re…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-862
vendor: Automattic
product: Sensei LMS
affected:
  - sensei_lms < 4.26.4
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T14:45:24.844Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112329'
references:
  - url: 'https://senseilms.com/release-notes/'
    label: Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/sensei-lms-broken-access-control-via-save-new-message
    label: >-
      VulnCheck Advisory: Sensei LMS 4.26.4 Broken Access Control via
      save_new_message
tags:
  - cve.org
ingestedAt: '2026-10-19T15:31:18.962Z'
---

## Overview

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.

## Affected

- `sensei_lms < 4.26.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.