Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass of Manual User Verification
- ID
- WPSEC-2026-2150
- Plugin
- Uncanny Toolkit for LearnDash (uncanny-learndash-toolkit)
- Affected
- all versions before 3.8.3
- Remediation
- Update to 3.8.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-287
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- Uncanny Toolkit for LearnDash on WPSec AttackSurface
- Fix released
- Published
Description
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass of the Front End Login Manual User Verification feature in all versions up to, and including, 3.8.2. This is due to the verification check in the 'authenticate' filter running only after early returns for REST requests, for request URIs containing '/wp-json/', and for requests carrying 'code' and 'state' parameters. In addition, the AJAX login checked verification against an account looked up differently from the one wp_signon() resolves, and the WP 2FA login flow logged users in without checking verification at all. This makes it possible for unauthenticated attackers who hold valid credentials for an account an administrator has not yet approved, such as one they registered themselves, to log in to the site. This only affects sites with manual user verification enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2150/
- https://plugins.svn.wordpress.org/uncanny-learndash-toolkit/tags/3.8.3/
- https://wordpress.org/plugins/uncanny-learndash-toolkit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS