Vulnerability in DT LMS WordPress Plugin Allows Unauthorized Data Modification

CVE-2026-11355

What is CVE-2026-11355?

The DT LMS plugin for WordPress is susceptible to unauthorized data modification due to missing capability checks in several AJAX handlers. This vulnerability allows unauthenticated attackers to exploit handlers such as dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings. With no capability validation or nonce verification in place, attackers can directly send user-supplied data to update_option(), which manipulates stored plugin settings in the wp_options table. Consequently, this poses a risk of altering critical elements like Point-of-Contact email configurations and branding settings, potentially impacting the site's overall appearance and functionality for all users.

References