sensei_lms vulnerabilities
CVEs whose affected-version data names the sensei_lms package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-112329Medium· 4.3Sensei LMS 4.26.4 Broken Access Control via save_new_message
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or re…
▾ SunlitAutomattic · Sensei LMSvia CVEORG
CVE-2026-112328Medium· 4.3Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by…
▾ SunlitAutomattic · Sensei LMSvia CVEORG