The plugin contains a broken access control flaw that lets any authenticated user, including users with the Subscriber role, create a private message to any course, lesson, or quiz author by specifying an arbitrary post_id. The handler only verifies a generic nonce and does not check that the victim user is enrolled in the specified course, or that the post_id corresponds to a valid lesson or quiz. This vulnerability is classified as CWE-862. Attackers can use the flaw to send private messages to any post author, thereby bypassing standard enrollment checks enforced by the newer REST send‑message controller.

The issue affects the Sensei LMS WordPress plugin prior to version 4.26.4, built by Automattic. Site owners running any older version of the plugin are susceptible. Specific product: Sensei LMS version 4.26.3 and earlier.

The CVSS score of 5.3 indicates moderate severity. The vulnerability can be leveraged by any authenticated user, including low‑privilege subscribers, so the attack vector is local user access. No EPSS score is available, and the flaw is not listed in CISA KEV, suggesting limited known exploitation. However, the breach of strict access control could allow attackers to hijack private messaging flows, potentially exposing sensitive user communications or enabling phishing campaigns aimed at course authors.