CVE-2026-106004

Full vulnerability record from the local CVENow database.

Description

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Received

Source identifier

[email protected]

Published

2026-11-03 06:17:37.640000

Last modified

2026-11-03 06:17:37.640000

View original CVE JSON

{
  "id": "CVE-2026-106004",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-03T06:17:37.640",
  "lastModified": "2026-11-03T06:17:37.640",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Unknown",
          "product": "DT LMS",
          "defaultStatus": "unknown",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "1.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "references": [
    {
      "url": "https://wpscan.com/vulnerability/f2a87670-ddbd-455b-884f-9b710d3bb600/",
      "source": "[email protected]"
    }
  ]
}