Sensei LMS CVE-2026-112329

Requires an authenticated WordPress account on the target site - any role down to unprivileged Subscriber suffices (PR:L), so sites allowing open user registration are most exposed. The vulnerable code path is the legacy save_new_message handler hooked on the init action, meaning the Sensei private-messaging feature must be present in the vulnerable version (before 4.26.4). The attacker must possess a valid generic nonce but no course enrollment is checked and no post_id type restriction is enforced. Limiting factors: a valid account is needed (no fully anonymous exploitation), no user interaction is required, and impact is confined to creating private messages to post authors (VI:L) with no confidentiality or availability consequences, which bounds realistic abuse to message/spam injection rather than data disclosure or takeover.

This is a low-to-moderate real-world risk that should not be treated as an urgent priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) yields a 5.3 (Medium) and the signals are internally consistent: network-reachable and low-complexity, but it requires an authenticated account (PR:L) and delivers only a low integrity impact (VI:L) with no confidentiality or availability impact. The vulnerability permits an unprivileged Subscriber to bypass course-enrollment authorization (CWE-862) and create an arbitrary private message to a post author - an access-control/data-integrity abuse, not code execution or data theft. There is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation status is speculative rather than confirmed. EPSS was not provided and cannot be cited. The practical ceiling of impact is unsolicited private-message creation / spam-like abuse within the LMS, which limits attacker value. Key missing data: no EPSS score and no POC signal were supplied, so exploitation likelihood is inferred from the vector alone.

An attacker registers a free Subscriber account on a WordPress site running Sensei LMS (before 4.26.4) where self-registration is enabled, then sends a crafted request to the legacy save_new_message handler on the init action with a valid generic nonce but an arbitrary post_id. Because the handler never verifies course enrollment or restricts post_id to valid post types, the attacker creates a private message addressed to any course, lesson, or quiz author without being enrolled. No public exploit code has been identified at time of analysis, so exploitation would require custom request crafting.