{
 "id": "WPSEC-2026-2152",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2152/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2152/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2152/index.md",
 "title": "Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via WP 2FA Login Integration",
 "description": "The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass via the Front End Login WP 2FA integration in all versions up to, and including, 3.8.2. This is due to the integration issuing the two-factor challenge from the 'wp_authenticate_user' filter, which WordPress runs before it checks the password, and to the challenge accepting unlimited code guesses without consuming the login nonce. This makes it possible for unauthenticated attackers who know the username of an account with two-factor authentication enabled, including an administrator account, to skip the password step and brute-force the second-factor code to log in as that user. This only affects sites with the Front End Login module enabled and the WP 2FA plugin active.",
 "plugin": {
  "slug": "uncanny-learndash-toolkit",
  "name": "Uncanny Toolkit for LearnDash",
  "full_name": "Uncanny Toolkit for LearnDash",
  "wordpress_org": "https://wordpress.org/plugins/uncanny-learndash-toolkit/",
  "advisories_url": "https://wpsec.com/vuln/plugin/uncanny-learndash-toolkit/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/uncanny-learndash-toolkit"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-287"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.8.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.8.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.8.3",
 "remediation": "Update to 3.8.3 or later.",
 "fix_released": "2026-10-29T20:41:59+00:00",
 "published": "2026-10-30T20:44:05+00:00",
 "updated": "2026-10-30T09:24:10.416403+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2152/",
  "https://plugins.svn.wordpress.org/uncanny-learndash-toolkit/tags/3.8.3/",
  "https://wordpress.org/plugins/uncanny-learndash-toolkit/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/uncanny-learndash-toolkit",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-30"
 }
}