DT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions
mediumThe DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers a...
- CVSS:
- 5.3 (Wordfence)
- Affected:
- up to 1.1
- Fixed in:
- 1.2
- Disclosed:
- Sep 11, 2026