CVE-2026-106004: Security vulnerability

Published Nov 3, 2026

Updated

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.

Event History

Nov 3, 2026

CVE Published

via NVD·06:17 AM

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker can exploit the affected AJAX action; no login is required.

What can an attacker change?

An attacker can revoke any learner's course-completion and class-completion status.

Are installations running version 1.2 affected?

Yes. The issue affects DT LMS WordPress plugin versions through 1.2, which includes version 1.2.

CVE-2026-106004: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Are installations running version 1.2 affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What can an attacker change?

Are installations running version 1.2 affected?