CVE-2026-11355: DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions
The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings) in versions up to, and including, 1.1. These handlers are registered on the wpajaxnopriv hook and contain no capability check, no nonce verification, and pass user-supplied data directly to updateoption(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wpoptions table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
DT LMS – elearning, WordPress LMS plugin for WordPressto a version that resolves this vulnerability.Fixed in 1.1 - Configuration
For the AJAX actions dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings, add a capability check and nonce verification, and do not allow execution via wp_ajax_nopriv_*; ensure user-supplied values are validated/sanitized before update_option().
DT LMS – elearning, WordPress LMS plugin for WordPress (AJAX handlers) Capability checks, nonce verification, and request authorization for AJAX actions = Add required capability check and nonce verification; only register handlers requiring authentication (remove use of wp_ajax_nopriv_* where appropriate) before calling update_option() with user-supplied data
Event History
Frequently Asked Questions
Which deployments are exposed?
WordPress sites using the DT LMS plugin in version 1.1 or earlier are affected. The vulnerable AJAX handlers are available to unauthenticated users, so an attacker does not need a WordPress account or administrative access.
What changes can an attacker make?
An attacker can overwrite plugin option values stored in the WordPress wp_options table through multiple settings-related AJAX actions. Documented examples include Point-of-Contact email settings and skin or branding settings, allowing changes to LMS appearance and behavior for site visitors.
What protections do these AJAX actions lack?
The affected handlers have no capability check and no nonce verification. They accept user-supplied data and pass it directly to update_option(), enabling unauthorized option modification.
How can I determine whether my site may already be affected?
Review DT LMS Point-of-Contact email, skin or branding, and other plugin settings for unexpected changes. Because the affected actions modify stored plugin options, compare current values in the plugin configuration or wp_options table against known-good configuration values.