DT LMS Plugin CVE-2026-11355

Exploitation requires that the target WordPress site has the DT LMS plugin (version ≤1.1) installed and activated, and that the standard WordPress admin-ajax.php endpoint is reachable over the network - a condition true for virtually all public WordPress installations. No authentication, no valid nonce, no specific browser, and no special server configuration are required; the handlers are intentionally exposed to unauthenticated users via wp_ajax_nopriv_*. Exploitation is bounded to overwriting plugin-managed option keys (LMS contact email, skin/branding settings stored in wp_options); attackers cannot directly overwrite arbitrary wp_options entries outside the plugin's own option namespace, and the CVSS vector confirms no confidentiality or availability impact.

CVSS 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the attack profile: trivially reachable over the network with no authentication, but with a constrained impact ceiling limited to integrity of plugin-managed options only. No EPSS data is present in the input; given the niche plugin footprint and absence of active exploitation signals, real-world risk is likely lower than the network-accessible vector implies. No CISA KEV listing and no confirmed public exploit code, which distinguishes this from more urgent missing-capability-check disclosures. The wp_ajax_nopriv attack pattern is well-catalogued in WordPress security tooling, meaning automated scanners could fingerprint and exploit this once a POC circulates. However, the attacker's impact is confined to overwriting LMS contact email and skin/branding options - a defacement-class impact rather than full site compromise. The 'Authentication Bypass' tag on this CVE is technically incorrect: this is an authorization failure (CWE-862), not circumvention of the authentication mechanism (CWE-287).

An attacker sends a crafted unauthenticated HTTP POST request to /wp-admin/admin-ajax.php with action=dtlms_save_poc_settings and a modified Point-of-Contact email value; WordPress routes the request to the nopriv handler, which writes the attacker-controlled value directly to wp_options without checking any nonce or capability. The attacker can redirect all LMS contact form submissions to an attacker-controlled address or inject malicious branding markup visible to all site visitors. No public exploit code is confirmed, but the technique requires only a single HTTP request and is well within the capability of automated WordPress vulnerability scanners.