CVE-2026-112328 | Automattic Sensei LMS Plugin up to 4.26.3 on WordPress Add New Module Term AJAX wp_set_object_terms course_id access control

October 19, 2026 Yanac

A vulnerability, which was classified as problematic, has been found in Automattic Sensei LMS Plugin up to 4.26.3 on WordPress. The affected element is the function wp_set_object_terms of the component Add New Module Term AJAX Handler. This manipulation of the argument course_id causes improper access controls.

This vulnerability is registered as CVE-2026-112328. Remote exploitation of the attack is possible. No exploit is available.

It is advisable to upgrade the affected component.VulDB Recent EntriesRead More