CVE-2026-106004

None

CVSS

—

EPSS

0.1%

Published

Nov 3, 2026

CISA due date

—

The record

The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.

Affected packages

Ecosystem	Package	Introduced	Fixed