CVE-2026-112328: Sensei LMS 0 to before 4.26.4

Affected technology

Sensei LMS · 0 to before 4.26.4
Automattic

Description’s affected range: before 4.26.4

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

Authenticated Teacher-role attackers can assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Vendor/CNA’s CVSS 4.0 assessment (base score 5.3/10) rates confidentiality and availability impact as none; integrity impact as low.