Sensei LMS EUVD-2026-104386

Requires an authenticated account with the Teacher role on a target site running Sensei LMS before 4.26.4; the attacker reuses a valid generic nonce from their own course metabox to call the add_new_module_term AJAX handler against an arbitrary course_id. Meaningful impact depends on a multi-author deployment where other teachers or administrators own courses that the attacker can target. Limiting factors: a valid Teacher-level login is mandatory (no unauthenticated path), no user interaction from a victim is needed, impact is confined to unauthorized assignment of module taxonomy terms (integrity only, no data disclosure or outage), and single-instructor sites have negligible exposure.

This is a moderate, not urgent, issue. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N) scores 5.3 (Medium) and is internally consistent with the description: network-reachable AJAX endpoint, low complexity, but requiring an authenticated Teacher-role account (PR:L) and yielding only low integrity impact (VI:L) with no confidentiality or availability loss. Exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no POC referenced in the provided data; it was reported through a VulnCheck advisory and is patched by the vendor. No EPSS score was supplied, so widespread-exploitation probability cannot be quantified. The signals are concordant rather than conflicting: a genuine authorization bug (CWE-862) with a real-but-bounded blast radius (unauthorized modification of other teachers'/admins' course module taxonomy), gated behind valid authenticated access. This is a legitimate defense-in-depth fix for multi-author Sensei LMS sites, but it is a bounded-integrity, authenticated-insider flaw rather than a high-real-risk unauthenticated RCE.

On a Sensei LMS site (before 4.26.4) hosting multiple teachers, a user with the Teacher role logs into their own course editor and captures the generic nonce issued for their course metabox. They then send a crafted add_new_module_term AJAX request specifying another instructor's or an administrator's course_id, causing module taxonomy terms to be assigned to a course they do not own. No public exploit code is referenced, but the attack is trivial to script given an authenticated Teacher session.