---
id: "CVE-2026-106004"
kind: "vulnerability"
aliases: ["CVE-2026-106004"]
title: "DT LMS WordPress plugin: unauthenticated users can revoke learners' course completions"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["dt-lms", "lms", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-03T06:17:37+00:00"
first_seen_at: "2026-11-03T06:18:59+00:00"
updated_at: "2026-11-03T06:20:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106004", "first_seen_at": "2026-11-03T06:18:59+00:00"}]
---

# DT LMS WordPress plugin: unauthenticated users can revoke learners' course completions

The DT LMS WordPress plugin through version 1.2 has an AJAX action that skips capability and nonce checks. An unauthenticated attacker can revoke any learner's course and class completion status.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the DT LMS plugin is installed and at version `1.2` or earlier in the WordPress plugins list or `wp plugin list`

## Timeline

- 2026-11-03T06:18:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106004

## From the sources

The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_