Security Alert Summary
The Sensei LMS WordPress plugin (prior to version 4.26.4) contains a broken access control vulnerability that allows authenticated users with low privileges to create private messages addressed to the author of an arbitrary course, lesson, or quiz by supplying an arbitrary post_id. The issue exists in a legacy handler that validates only a generic nonce and does not enforce enrollment or post type restrictions.
CVE Details
- CVE ID: CVE-2026-112329
- Affected component: Sensei LMS WordPress plugin (legacy message handler)
- Affected versions: versions prior to 4.26.4 (less than 4.26.4)
- Published: October 19, 2026 at 3:17:06 PM
- Last modified: October 19, 2026 at 3:17:06 PM
- CVSS v3.1 base score: 4.3 (MEDIUM)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: Authentication required (authenticated user); privileges required: LOW; user interaction: NONE
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The vulnerability is a broken access control issue in a legacy handler named save_new_message that is hooked on the init action. That handler validates only a generic nonce but does not verify that the sender is enrolled in the specified course or that the supplied post_id refers to an allowed post type. As a result, an authenticated user with low privileges (for example, a Subscriber) can supply an arbitrary post_id for any course, lesson, or quiz and create a private message addressed to the author of that post.
The vulnerability bypasses the enrollment checks that are enforced by the newer REST controller for sending messages (the REST send-message controller). The root cause is missing authorization checks restricting which post_id values an authenticated user may target and a lack of enrollment verification in the legacy handler.
Impact is limited to the ability to create private messages to arbitrary post authors without enrollment. The CVSS v3.1 data indicates integrity impact is low and there is no direct confidentiality or availability impact listed.
How This Could Impact Your Website
Consider a site with a site owner, internal instructional staff, and external contributors or contractors. An unprivileged authenticated user could send private messages to course or lesson authors they are not enrolled with. Practical consequences include additional unwanted messages to staff or instructors and a potential avenue for targeted social engineering or phishing attempts aimed at those authors.
Note that the CVSS metrics list confidentiality impact as NONE, so the vulnerability does not indicate direct disclosure of stored secrets. However, because attackers can initiate private messages to chosen authors, it can create communication channels that increase the risk of social engineering. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially accounts with contributor or subscriber privileges that are not needed.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and legacy handlers that are no longer required.
- Monitor site activity and message logs for unusual behavior, such as unexpected messages targeting staff or authors.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
