The Uncanny Toolkit for LearnDash WordPress plugin version 3.8.1 and earlier accepts requests to change a user’s verification status without verifying that the acting user has the authority to manage that user. An attacker who can assume the role of a subsite administrator on a WordPress multisite network can therefore mark arbitrary network users outside their own site as unverified, effectively preventing those users from logging in. This flaw leads to denial of access for legitimate network members and can undermine the availability of the network.

The vulnerability affects the Uncanny Toolkit for LearnDash WordPress plugin for multisite networks, specifically versions earlier than 3.8.2. Users who run any of these affected plugin versions on a multisite WordPress installation are susceptible to the issue.

The vulnerability has a CVSS score of 5.0 and an EPSS score of < 1%, and is not listed in the CISA KEV catalog. The flaw requires an attacker to be authenticated as a subsite administrator on a multisite network. Once authenticated, the attacker can target any network user outside their own site and mark them as unverified, effectively preventing those users from logging in. This action disables legitimate network members and compromises the availability of the network. The requirement for an existing role reduces the breadth of individuals who could exploit the flaw, but the low EPSS score indicates that exploitation is unlikely to be widespread in the near term.