PT-2026-136028

CVE-2026-106004

Published

2026-11-03

Updated

2026-11-03

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions DT LMS WordPress plugin versions prior to 1.3

Description The plugin fails to perform capability or nonce checks on an AJAX action. This allows unauthenticated attackers to revoke the course and class completion status of any learner. The issue stems from a missing capability check within a function, enabling unauthorized access and actions.

Recommendations Update the plugin to a version newer than 1.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Claudio Marchesini

Dottor Marc

Enrico Marcolini

Vendors

Affected products

Weakness enumeration