Description

The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX handlers (including dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings) in versions up to, and including, 1.1. These handlers are registered on the wp_ajax_nopriv_* hook and contain no capability check, no nonce verification, and pass user-supplied data directly to update_option(). This makes it possible for unauthenticated attackers to overwrite arbitrary plugin option values stored in the wp_options table, including Point-of-Contact email configuration and skin/branding settings, which can be used to alter the appearance and behavior of the LMS for all site visitors.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T08:16:22.523Z",
  "pubdate": "2026-09-12T08:16:22.523Z",
  "executiveSummary": "The DT LMS WordPress plugin suffers from an unauthorized modification of data vulnerability due to missing access control mechanisms in its AJAX handler suite.\nThe vulnerability allows unauthenticated remote attackers to modify arbitrary settings within the WordPress wp_options table by leveraging improperly secured AJAX hooks.\nAffected versions include DT LMS up to and including 1.1.\nThe primary impact involves the unauthorized modification of critical plugin configuration settings, such as Point-of-Contact (PoC) email addresses and administrative branding/skin parameters.\nBecause the affected hooks are registered with the wp_ajax_nopriv_ prefix and lack both capability checks and CSRF protection (nonce verification), exploitation requires no authentication or administrative privileges.\nThe risk implication is high, as an attacker can manipulate the LMS environment, potentially intercepting administrative communications or defacing the learning portal, thereby compromising the integrity of the plugin's configuration and the platform's reliability.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of AJAX handlers within the DT LMS plugin. The plugin registers several administrative action handlers—specifically dtlms_save_poc_settings, dtlms_save_skin_settings, and dtlms_save_options_settings—using the wp_ajax_nopriv_ hook prefix.\nBy using the nopriv variant of the WordPress AJAX API, the developer explicitly permits unauthenticated users to trigger these functions. Furthermore, the functions associated with these hooks lack any server-side capability checks (such as current_user_can('manage_options')) to ensure the request originator holds administrative privileges.\nBeyond the lack of authorization, the handlers fail to implement nonce verification. Nonces are critical in the WordPress ecosystem to ensure that the request originated from the intended administrative dashboard rather than an external source. Without this, the system is susceptible to direct parameter manipulation via unauthorized POST requests.\nThe exploitation process follows a predictable attack flow: an unauthenticated attacker sends a specially crafted HTTP POST request to the WordPress admin-ajax.php endpoint. The request targets one of the aforementioned vulnerable actions (e.g., action=dtlms_save_poc_settings) and includes arbitrary data in the POST body. Because the underlying PHP handler blindly accepts these inputs and passes them directly into the update_option() WordPress function, the database is modified immediately upon receipt of the request.\nThe impact is significant, as an attacker can overwrite values stored in the wp_options table that dictate the operational behavior of the LMS. For example, modifying the 'dtlms_save_poc_settings' allows an attacker to divert legitimate inquiry or administrative emails to an external mailbox under their control, facilitating social engineering or data exfiltration. Similarly, modifying skin and branding settings allows for the defacement of the LMS interface, which could be used to host phishing content or misleading educational material. Because the plugin performs no validation on the data passed to update_option(), an attacker is essentially provided with a primitive to modify any internal plugin state stored within the options database, resulting in a complete loss of configuration integrity."
}