Description
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
Published: 2026-10-21
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Account takeover via forged password reset
Action: Patch
AI Analysis

Impact

The Uncanny Toolkit for LearnDash plugin for WordPress before version 3.8.2 does not verify the origin of password‑reset requests. An unauthenticated attacker can forge a request while a legitimate user is in the middle of resetting their password, causing the password to be overwritten with an attacker‑chosen value. This results in complete control of the affected account.

Affected Systems

The vulnerability affects the WordPress plugin Uncanny Toolkit for LearnDash on all installations running any version prior to 3.8.2. It is present on all WordPress sites that have the plugin installed and have not yet applied the official patch.

Risk and Exploitability

The CVSS score is 7.5, indicating high severity. The EPSS score is < 1%, suggesting a low exploitation probability overall, but the presence of an unauthenticated CSRF vector and no request origin validation make this vulnerability viable for attackers who can send forged requests. The vulnerability is not listed in the CISA KEV catalog. Administrators should treat this as a high‑risk vulnerability.

Generated by OpenCVE AI on October 22, 2026 at 02:30 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Uncanny Toolkit for LearnDash to version 3.8.2 or later to apply the fix.
  • Configure your site or apply a security plugin to reject password‑reset requests that lack proper authentication or referer validation, thereby mitigating CSRF for this endpoint.
  • Monitor password reset and login logs for suspicious activity, and enforce temporary lockouts or additional verification for unusual reset attempts.

Generated by OpenCVE AI on October 22, 2026 at 02:30 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 17:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 11:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-352
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 06:15:00 +0000

Type Values Removed Values Added
Description The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
Title Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-21T10:35:06.035Z

Reserved: 2026-10-07T07:50:28.731Z

Link: CVE-2026-107127

cve-icon Vulnrichment

Updated: 2026-10-21T10:21:45.461Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T06:16:46.687

Modified: 2026-10-21T18:37:38.700

Link: CVE-2026-107127

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T02:45:07Z

Weaknesses
  • CWE-352

    Cross-Site Request Forgery (CSRF)