CVE-2026-112329: falha de média gravidade em Automattic Sensei LMS
Sensei LMS 4.26.4 Broken Access Control via save_new_message
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.2%
The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
Automattic · Sensei LMSCVEs relacionadas — Automattic Sensei LMS
No mesmo produto, das mais perigosas para as menos.
CVE-2024-35686MEDIUMWordPress Sensei LMS plugin <= 4.23.1 - Broken Access Control vulnerabilityEPSS 0.6%CVE-2025-22740MEDIUMWordPress Sensei LMS plugin <= 4.24.4 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2026-112328MEDIUMSensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAXEPSS 0.2%