Live › vulnerability › CVE-2026-106004
The DT LMS WordPress plugin through version 1.2 has an AJAX action that skips capability and nonce checks. An unauthenticated attacker can revoke any learner's course and class completion status.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 06:18 UTC. All times on this page are UTC.
Sites running the DT LMS WordPress plugin through version 1.2 are exposed, since the flawed AJAX action is reachable without logging in. Sites without this plugin are not affected. The sources do not say whether a later version fixes it.
No product ranges from the sources yet.
1.2 or earlier in the WordPress plugins list or wp plugin listNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.
This page as .md · .json · in your agent: get_signal("CVE-2026-106004")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.