Description
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.
Published: 2026-10-31
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: Authentication bypass allowing attackers to log in as verified or suspended users using known credentials
Action: Immediate Patch
AI Analysis

Impact

The Uncanny Toolkit for LearnDash contains a parsing flaw that allows an unauthenticated attacker to bypass the plugin’s account‑verification gate. The email value supplied to the login action is passed unsanitized to get_user_by() while the subsequent authentication call sanitizes the username, causing the verification check to be skipped and a valid session to be created. This vulnerability enables attackers to log in to any user account for which they already know the password, including suspended or unverified accounts, and obtain a full WordPress login session. The weakness is classified as CWE‑287.

Affected Systems

All installations of the Uncanny Toolkit for LearnDash released up to and including version 3.8.2 are affected. The vendor, UncannyOwl, must update the plugin to a patched release to remediate the issue.

Risk and Exploitability

The CVSS base score is 9.8, indicating a critical level of risk. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires only network access to the site, the ability to interact with the frontend login endpoint, and knowledge of a valid user’s credentials. The attacker can obtain the required nonce from a public endpoint and then perform login with a crafted email parameter, making the attack trivial for anyone with credentials and site access.

Generated by OpenCVE AI on October 31, 2026 at 09:26 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Uncanny Toolkit for LearnDash to version 3.8.3 or later
  • Verify that all user accounts are properly verified and that no suspended or unverified accounts remain accessible
  • Audit user activity logs and monitor for unexpected login attempts

Generated by OpenCVE AI on October 31, 2026 at 09:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 31 Oct 2026 08:00:00 +0000

Type Values Removed Values Added
Description The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.
Title Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-31T07:46:49.237Z

Reserved: 2026-10-29T13:58:03.278Z

Link: CVE-2026-119096

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-31T08:16:49.043

Modified: 2026-10-31T08:16:49.043

Link: CVE-2026-119096

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-31T09:30:14Z

Weaknesses