---
id: CVE-2026-106004
title: DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation
summary: >-
  The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce
  checks on one of its AJAX actions, allowing unauthenticated attackers to
  revoke any learner's course and class completion status.
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-284
product: DT LMS
affected:
  - dt_lms <= 1.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-04T14:09:17.554004Z'
published: '2026-11-03'
updated: '2026-11-04'
sourceUpdated: '2026-11-04T14:18:24.511Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-106004'
references:
  - url: 'https://wpscan.com/vulnerability/f2a87670-ddbd-455b-884f-9b710d3bb600/'
tags:
  - cve.org
epss: 0.00185
epssPercentile: 0.0819
ingestedAt: '2026-11-05T21:36:00.384Z'
---

## Overview

The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.

## Affected

- `dt_lms <= 1.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.