The Uncanny Toolkit for LearnDash plugin version 3.8.1 and earlier accepts requests to change a user’s verification status without verifying that the acting user has the authority to manage that user. An attacker who can assume the role of a subsite administrator on a WordPress multisite network can therefore mark arbitrary network users outside their own site as unverified, effectively preventing those users from logging in. This flaw leads to denial of access for legitimate network members and can undermine the availability of the entire network.

The vulnerability affects the Uncanny Toolkit for LearnDash WordPress plugin for multisite networks, specifically versions earlier than 3.8.2. Users who run any of these affected plugin versions on a multisite WordPress installation are susceptible to the issue.

No CVSS score or EPSS value is publicly available for this vulnerability, and it is not listed in the CISA KEV catalog. The exploit requires authentication as a subsite administrator—a role that may be held by many collaborators on a multisite network. Once authenticated, the attacker can directly target any network user outside their own site, leading to widespread account lockout. Given the high potential impact and the assumption that many sites may have subsite administrators with broad privileges, the risk remains significant until the plugin is updated or other controls are applied.