CVE-2026-106004
DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.
| Vendor | unknown |
| Product | dt lms |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown dt lms
Be the first to know when new unknown vulnerabilities affecting unknown dt lms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / DT LMS
0 ≤ 1.2
References
Credits
Enrico Marcolini Claudio Marchesini Dottor Marc WPScan