CVE-2026-106004 PUBLISHED

DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation

Assigner: WPScan
Reserved: 06.10.2026 Published: 03.11.2026 Updated: 03.11.2026

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.

Product Status

Vendor Unknown
Product DT LMS
Versions Default: unknown
  • affected from 0 to 1.2 (incl.)

Credits

  • Enrico Marcolini finder
  • Claudio Marchesini finder
  • Dottor Marc finder
  • WPScan coordinator

References

Problem Types

  • CWE-284 Improper Access Control CWE