The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlmssavepocsettings, dtlmssaveskinsettings, and dtlmssaveoptionssettings) in versions up to, and including, 1.1. These handlers are registered on the wpajaxnopriv hook and contain no capability check, no nonce verification, and pass user-supplied data directly to updateoption(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wpoptions table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors.