CVE-2026-106004

unknown · dt lms

DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation

Description

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.

Affected Products

Vendor	Product	Versions
unknown	dt lms	0

References

https://wpscan.com/vulnerability/f2a87670-ddbd-455b-884f-9b710d3bb600/(exploit, vdb-entry, technical-description)

Related News (1 articles)

Tier C

VulDB17h ago

CVE-2026-106004 | DT LMS Plugin up to 1.2 on WordPress access control

→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.19.1 CRITICAL

CISA KEV❌ No

Actively exploited❌ No

CWECWE-284

PublishedNov 3, 2026

Last enriched16h agov2

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-81648EXPKEV

CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router

Trending: 122

CRITICALCVE-2026-104647

weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

Trending: 29

CRITICALCVE-2026-105967

Gallery for Social Photo <= 1.0.0.41 - Unauthenticated SSRF via next_url Parameter

Trending: 29

CRITICALCVE-2026-105993

DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update

Trending: 29

HIGHCVE-2026-103379

WATI Chat and Notification <= 1.1.8 - Unauthenticated Customer Order PII Disclosure via Leaked API Token

Trending: 27

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Nov 3, 2026

Discovered by ZDM

Nov 3, 2026

Updated: severity, cvssEstimate, cweIds, tags

Nov 3, 2026

Version History

Last enriched 16h ago

v2Tier C16h ago

Updated severity from NONE to CRITICAL, assigned CVSS estimate of 9.1, added CWE-284 for improper access control, and added relevant tags.

severitycvssEstimatecweIdstags

via VulDB

v116h ago

Initial creation