Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via WP 2FA Login Integration
- ID
- WPSEC-2026-2152
- Plugin
- Uncanny Toolkit for LearnDash (uncanny-learndash-toolkit)
- Affected
- all versions before 3.8.3
- Remediation
- Update to 3.8.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-287
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-30
- Attack surface
- Uncanny Toolkit for LearnDash on WPSec AttackSurface
- Fix released
- Published
Description
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass via the Front End Login WP 2FA integration in all versions up to, and including, 3.8.2. This is due to the integration issuing the two-factor challenge from the 'wp_authenticate_user' filter, which WordPress runs before it checks the password, and to the challenge accepting unlimited code guesses without consuming the login nonce. This makes it possible for unauthenticated attackers who know the username of an account with two-factor authentication enabled, including an administrator account, to skip the password step and brute-force the second-factor code to log in as that user. This only affects sites with the Front End Login module enabled and the WP 2FA plugin active.
References
- https://wpsec.com/vuln/WPSEC-2026-2152/
- https://plugins.svn.wordpress.org/uncanny-learndash-toolkit/tags/3.8.3/
- https://wordpress.org/plugins/uncanny-learndash-toolkit/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS