CVE-2026-106004

{
  "etk_id": "ETK-2026-3342",
  "cve_id": "CVE-2026-106004",
  "display_id": "CVE-2026-106004",
  "ghsa_id": "GHSA-8rjq-x73f-6p5g",
  "euvd_id": "EUVD-2026-115680",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated AJAX authorization flaw in DT LMS",
  "summary": "DT LMS for WordPress through version 1.2 has an AJAX action that does not verify authorization or request integrity. An unauthenticated attacker can use the exposed action to remove learners' course and class completion status; the affected AJAX functionality must be reachable.",
  "mitigation": "Disable DT LMS where feasible, or restrict unauthenticated access to its AJAX functionality with network or application-layer controls. Review learner completion records for unexpected changes and apply a vendor update when a fixed release is available.",
  "vendor": null,
  "product": "DT LMS",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "DT LMS",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 42.89087335,
  "t0_at": "2026-11-03T06:00:23.247000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-03T07:19:28.834590+00:00",
      "days": 0.05492578229166667,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T06:00:23.247000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-03T06:00:23.247000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T06:00:23.247000+00:00",
      "url": "https://github.com/advisories/GHSA-8rjq-x73f-6p5g"
    }
  }
}