CVE-2026-112328

The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add new module term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course id, since the handler validates only a generic nonce and checks manage options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp set object terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.