{"metadata": {"vulnerability": "CVE-2026-112328", "count": 14, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 9}}, "data": [{"timestamp": "2026-09-29T00:00:00Z", "date_only": false, "value": "2026-09-29T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-112328", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-19T14:41:46.700Z", "date_only": false, "value": "2026-10-19T14:41:46.700Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-112328", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-19T14:44:00.760Z", "date_only": false, "value": "2026-10-19T14:44:00.760Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-112328", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-19T14:44:00.760Z", "date_only": false, "value": "2026-10-19T14:44:00.760Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-112328", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T14:49:47.975Z", "date_only": false, "value": "2026-10-19T14:49:47.975091Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117468128053332890", "record": "CVE-2026-112328", "field": "creation_timestamp", "uuid": "f189ef53-4946-43b3-b1af-f8437c58d13e", "content": "CVE-2026-112328 Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own.\nhttps://www.cve.org/CVERecord?id=CVE-2026-112328https://senseilms.com/release-notes/https://www.vulncheck.com/advisories/sensei-lms-broken-access-control-via-add-new-module-term-ajax#Automattic #SenseiLMS#CVE_2026_112328#bot", "url": "https://infosec.exchange/users/cve/statuses/117468128053332890"}, {"timestamp": "2026-10-19T15:17:06Z", "date_only": false, "value": "2026-10-19T15:17:06Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-3HM9-HGV5-W9HG", "record": "GHSA-3HM9-HGV5-W9HG", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-19T15:17:06.280Z", "date_only": false, "value": "2026-10-19T15:17:06.280", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112328", "record": "FKIE_CVE-2026-112328", "field": "published"}, {"timestamp": "2026-10-19T15:32:42Z", "date_only": false, "value": "2026-10-19T15:32:42Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-3HM9-HGV5-W9HG", "record": "GHSA-3HM9-HGV5-W9HG", "field": "published"}, {"timestamp": "2026-10-19T15:32:42Z", "date_only": false, "value": "2026-10-19T15:32:42Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-3HM9-HGV5-W9HG", "record": "GHSA-3HM9-HGV5-W9HG", "field": "modified"}, {"timestamp": "2026-10-19T18:28:57.693Z", "date_only": false, "value": "2026-10-19T18:28:57.693553Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-112328", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-19T18:28:57.693Z", "date_only": false, "value": "2026-10-19T18:28:57.693553Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112328", "record": "FKIE_CVE-2026-112328", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-19T18:29:06.036Z", "date_only": false, "value": "2026-10-19T18:29:06.036Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-112328", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-19T18:29:06.036Z", "date_only": false, "value": "2026-10-19T18:29:06.036Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-112328", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-19T21:14:14.150Z", "date_only": false, "value": "2026-10-19T21:14:14.150", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-112328", "record": "FKIE_CVE-2026-112328", "field": "lastModified"}]}