# Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass of Manual User Verification

- **ID:** WPSEC-2026-2150
- **Plugin:** Uncanny Toolkit for LearnDash (`uncanny-learndash-toolkit`), https://wordpress.org/plugins/uncanny-learndash-toolkit/
- **Affected versions:** all versions before 3.8.3
- **Fixed in:** 3.8.3 (Update to 3.8.3 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/uncanny-learndash-toolkit
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2150/

## Description

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass of the Front End Login Manual User Verification feature in all versions up to, and including, 3.8.2. This is due to the verification check in the 'authenticate' filter running only after early returns for REST requests, for request URIs containing '/wp-json/', and for requests carrying 'code' and 'state' parameters. In addition, the AJAX login checked verification against an account looked up differently from the one wp_signon() resolves, and the WP 2FA login flow logged users in without checking verification at all. This makes it possible for unauthenticated attackers who hold valid credentials for an account an administrator has not yet approved, such as one they registered themselves, to log in to the site. This only affects sites with manual user verification enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-2150/
- https://plugins.svn.wordpress.org/uncanny-learndash-toolkit/tags/3.8.3/
- https://wordpress.org/plugins/uncanny-learndash-toolkit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2150/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.