{"api_version":"1","generated_at":"2026-11-03T18:05:38+00:00","cve":"CVE-2026-106004","urls":{"html":"https://cve.report/CVE-2026-106004","api":"https://cve.report/api/cve/CVE-2026-106004.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-106004","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-106004"},"summary":{"title":"DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation","description":"The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.","state":"PUBLISHED","assigner":"WPScan","published_at":"2026-11-03 06:17:37","updated_at":"2026-11-03 16:30:49"},"problem_types":["CWE-284 Improper Access Control"],"metrics":[],"references":[{"url":"https://wpscan.com/vulnerability/f2a87670-ddbd-455b-884f-9b710d3bb600/","name":"https://wpscan.com/vulnerability/f2a87670-ddbd-455b-884f-9b710d3bb600/","refsource":"contact@wpscan.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-106004","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106004","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Unknown","product":"DT LMS","version":"affected 1.2 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Enrico Marcolini","lang":"en"},{"source":"CNA","value":"Claudio Marchesini","lang":"en"},{"source":"CNA","value":"Dottor Marc","lang":"en"},{"source":"CNA","value":"WPScan","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unknown","product":"DT LMS","vendor":"Unknown","versions":[{"lessThanOrEqual":"1.2","status":"affected","version":"0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"finder","value":"Enrico Marcolini"},{"lang":"en","type":"finder","value":"Claudio Marchesini"},{"lang":"en","type":"finder","value":"Dottor Marc"},{"lang":"en","type":"coordinator","value":"WPScan"}],"descriptions":[{"lang":"en","value":"The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status."}],"problemTypes":[{"descriptions":[{"description":"CWE-284 Improper Access Control","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-03T06:00:23.247Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","shortName":"WPScan"},"references":[{"tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/f2a87670-ddbd-455b-884f-9b710d3bb600/"}],"source":{"discovery":"EXTERNAL"},"title":"DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation","x_generator":{"engine":"WPScan CVE Generator"}}},"cveMetadata":{"assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","assignerShortName":"WPScan","cveId":"CVE-2026-106004","datePublished":"2026-11-03T06:00:23.247Z","dateReserved":"2026-10-06T11:58:09.801Z","dateUpdated":"2026-11-03T06:00:23.247Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-03 06:17:37","lastModifiedDate":"2026-11-03 16:30:49","problem_types":["CWE-284 Improper Access Control"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"106004","Ordinal":"1","Title":"DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revo","CVE":"CVE-2026-106004","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"106004","Ordinal":"1","NoteData":"The DT LMS  WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status.","Type":"Description","Title":"DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revo"}]}}}