Description
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
Published: 2026-10-21
Score: 7.5 High
EPSS: n/a
KEV: No
Impact: Account takeover via forged password reset
Action: Patch
AI Analysis

Impact

The Uncanny Toolkit for LearnDash plugin for WordPress before version 3.8.2 does not verify the origin of password‑reset requests. An unauthenticated attacker can forge a request while a legitimate user is in the middle of resetting their password, causing the password to be overwritten with an attacker‑chosen value. This results in complete control of the affected account.

Affected Systems

The vulnerability affects the WordPress plugin Uncanny Toolkit for LearnDash on all installations running any version prior to 3.8.2. It is present on all WordPress sites that have the plugin installed and have not yet applied the official patch.

Risk and Exploitability

The CVSS score is not provided; however the impact is high because full account takeover is possible. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so while the probability of exploitation is unknown, the presence of an unauthenticated CSRF vector and the lack of request validation make exploitation likely for attackers able to send forged requests. Administrators should treat this as a high‑risk vulnerability.

Generated by OpenCVE AI on October 21, 2026 at 11:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Uncanny Toolkit for LearnDash to version 3.8.2 or later to apply the fix.
  • Configure your site or apply a security plugin to reject password‑reset requests that lack proper authentication or referer validation, thereby mitigating CSRF for this endpoint.
  • Monitor password reset and login logs for suspicious activity, and enforce temporary lockouts or additional verification for unusual reset attempts.

Generated by OpenCVE AI on October 21, 2026 at 11:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-352
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
Title Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-21T10:35:06.035Z

Reserved: 2026-10-07T07:50:28.731Z

Link: CVE-2026-107127

cve-icon Vulnrichment

Updated: 2026-10-21T10:21:45.461Z

cve-icon NVD

Status : Received

Published: 2026-10-21T06:16:46.687

Modified: 2026-10-21T11:17:02.373

Link: CVE-2026-107127

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T11:30:15Z

Weaknesses
  • CWE-284

    Improper Access Control

  • CWE-352

    Cross-Site Request Forgery (CSRF)