The vulnerability resides in the add_new_module_term AJAX handler of the Sensei LMS WordPress plugin, which fails to verify that a caller has permission to edit a specific course. An attacker with the Teacher role can supply a crafted course_id and reuse a nonce that they already possess, causing the system to execute wp_set_object_terms on an arbitrary course. This allows the attacker to assign taxonomy terms (e.g., module categories) to courses that belong to other teachers or administrators, effectively altering course content that they do not own. The flaw is a classic broken access control weakness (CWE‑862). The potential impact is the unauthorized modification of course metadata, which can affect course organization, visibility, and user experience.

Any WordPress installation running the Sensei LMS plugin before version 4.26.4 is vulnerable. The flaw affects all deployments where the plugin is enabled for Teacher‑role users; administrators who rely on Instructor data integrity are also at risk if other teachers use the compromised interface.

The CVSS score of 5.3 suggests a moderate severity, and while an EPSS score is not available, this is an authenticated attack that requires the Teacher role. Because the attacker can reuse a nonce from their own course, the execution effort is minimal. The vulnerability is not listed in CISA’s KEV catalog, indicating that no widely known exploits are reported. Nonetheless, the attack vector is relatively straightforward: logged‑in users with Teacher capabilities can invoke the problematic AJAX action, making the risk moderate but present in environments that rely on strict course ownership controls.