{"id":"CVE-2026-106004","kind":"vulnerability","aliases":["CVE-2026-106004"],"related":[],"title":"DT LMS WordPress plugin: unauthenticated users can revoke learners' course completions","description":"The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.","summary":"The DT LMS WordPress plugin through version 1.2 has an AJAX action that skips capability and nonce checks. An unauthenticated attacker can revoke any learner's course and class completion status.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dt-lms","lms","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the DT LMS plugin is installed and at version `1.2` or earlier in the WordPress plugins list or `wp plugin list`","fix":null,"status":"open","published_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:59+00:00","triaged_at":"2026-11-03T06:20:50+00:00","updated_at":"2026-11-03T06:20:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T06:20:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"DT LMS WordPress plugin: unauthenticated users can revoke learners' course completions","impact":"low","summary":"The DT LMS WordPress plugin through version 1.2 has an AJAX action that skips capability and nonce checks. An unauthenticated attacker can revoke any learner's course and class completion status.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","lms","dt-lms"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attackers reset learners' course and class completion records","analyst_note":"Check the NVD entry and the plugin's WordPress.org page for a fixed version after 1.2 and the exact AJAX action name.","how_to_check":"- Check whether the DT LMS plugin is installed and at version `1.2` or earlier in the WordPress plugins list or `wp plugin list`\n- unknown for other checks, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the DT LMS WordPress plugin through version 1.2 are exposed, since the flawed AJAX action is reachable without logging in. Sites without this plugin are not affected. The sources do not say whether a later version fixes it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00066,"input_tokens":4093,"output_tokens":502,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106004':14A,17A '-2026':13A,16A '1.2':31B,61C 'action':35B,74C 'ajax':34B,73C 'allow':75C 'attack':44B,77C 'capabl':38B,65C 'check':41B,68C 'class':52B,85C 'complet':11A,53B,86C 'cours':10A,50B,83C 'cve':12A,15A 'dt':1A,19B,25B,56C 'dt-lms':18B 'learner':9A,48B,81C 'lms':2A,20B,21B,26B,57C 'nonc':40B,67C 'one':70C 'packag':22B 'perform':64C 'plugin':4A,28B,59C 'revok':8A,46B,79C 'skip':37B 'status':54B,87C 'unauthent':5A,43B,76C 'user':6A 'version':30B 'wordpress':3A,23B,27B,58C","nicknames":[],"mitigations":[],"who_affected":"Sites running the DT LMS WordPress plugin through version 1.2 are exposed, since the flawed AJAX action is reachable without logging in. Sites without this plugin are not affected. The sources do not say whether a later version fixes it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dtlms","lms","medium","package","wordpress"],"first_public_at":"2026-11-03T06:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106004","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106004","severity":null,"published_at":"2026-11-03T06:17:37+00:00","modified_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:59+00:00","fetched_at":"2026-11-03T06:18:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}