EUVD-2026-76836
GHSA-xcq8-9qm4-gwm6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Nopriv AJAX handlers are unauthenticated by design (PR:N, AV:N); impact is restricted to overwriting plugin option values (I:L) with no confidentiality or availability consequence.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The DT LMS - elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors.
AnalysisAI
Unauthenticated option-overwrite in DT LMS <=1.1 allows any remote attacker to modify arbitrary plugin settings stored in the WordPress wp_options table by calling three unprotected AJAX handlers - dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings - that are registered on wp_ajax_nopriv_* with no nonce validation, no capability check, and no input filtering before update_option() is invoked. Confirmed by Wordfence with direct source-code references; a patch commit (changeset 3585901) is present in the WordPress plugin repository but the exact released version number is not stated in available data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has the DT LMS plugin (version ≤1.1) installed and activated, and that the standard WordPress admin-ajax.php endpoint is reachable over the network - a condition true for virtually all public WordPress installations. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately reflects the attack profile: trivially reachable over the network with no authentication, but with a constrained impact ceiling limited to integrity of plugin-managed options only. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the DT LMS plugin to a version beyond 1.1; a fix has been committed to the WordPress.org plugin SVN repository at changeset 3585901 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3585901%40dt-lms-lite&new=3585901%40dt-lms-lite). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today