CVE-2026-11355: CWE-862 Missing Authorization in designthemes DT LMS – elearning, WordPress LMS Plugin
The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors.
AI Analysis
Technical Summary
The DT LMS – elearning WordPress LMS plugin versions up to and including 1.1 contain multiple AJAX handlers (dtlms_save_poc_settings, dtlms_save_skin_settings, dtlms_save_options_settings) registered on the wp_ajax_nopriv_* hook without capability checks or nonce verification. These handlers accept user-supplied data and directly call update_option(), allowing unauthenticated attackers to overwrite arbitrary plugin option values in the wp_options table. This missing authorization (CWE-862) vulnerability enables unauthorized modification of LMS configuration such as Point-of-Contact email and skin/branding settings.
Potential Impact
An unauthenticated attacker can modify plugin options, including contact email and branding settings, potentially altering the LMS's appearance and behavior for all users. The vulnerability does not impact confidentiality or availability but allows integrity compromise of plugin configuration.
Mitigation Recommendations
No official patch or vendor advisory is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AJAX endpoints if possible, or disable the plugin if unauthorized modification risk is unacceptable.
CVE-2026-11355: CWE-862 Missing Authorization in designthemes DT LMS – elearning, WordPress LMS Plugin
Description
The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors.
CVSS v3.1
Score 5.3medium
Affected software
designthemes
DT LMS – elearning, WordPress LMS Plugin
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The DT LMS – elearning WordPress LMS plugin versions up to and including 1.1 contain multiple AJAX handlers (dtlms_save_poc_settings, dtlms_save_skin_settings, dtlms_save_options_settings) registered on the wp_ajax_nopriv_* hook without capability checks or nonce verification. These handlers accept user-supplied data and directly call update_option(), allowing unauthenticated attackers to overwrite arbitrary plugin option values in the wp_options table. This missing authorization (CWE-862) vulnerability enables unauthorized modification of LMS configuration such as Point-of-Contact email and skin/branding settings.
Potential Impact
An unauthenticated attacker can modify plugin options, including contact email and branding settings, potentially altering the LMS's appearance and behavior for all users. The vulnerability does not impact confidentiality or availability but allows integrity compromise of plugin configuration.
Mitigation Recommendations
No official patch or vendor advisory is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected AJAX endpoints if possible, or disable the plugin if unauthorized modification risk is unacceptable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-06-05T11:27:17.361Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aa5037555bf5e2cf506c90e
Added to database: 09/12/2026, 07:47:01 UTC
Last enriched: 09/12/2026, 08:03:07 UTC
Last updated: 09/13/2026, 02:28:31 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.