# Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via WP 2FA Login Integration

- **ID:** WPSEC-2026-2152
- **Plugin:** Uncanny Toolkit for LearnDash (`uncanny-learndash-toolkit`), https://wordpress.org/plugins/uncanny-learndash-toolkit/
- **Affected versions:** all versions before 3.8.3
- **Fixed in:** 3.8.3 (Update to 3.8.3 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-287
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/uncanny-learndash-toolkit
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2152/

## Description

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass via the Front End Login WP 2FA integration in all versions up to, and including, 3.8.2. This is due to the integration issuing the two-factor challenge from the 'wp_authenticate_user' filter, which WordPress runs before it checks the password, and to the challenge accepting unlimited code guesses without consuming the login nonce. This makes it possible for unauthenticated attackers who know the username of an account with two-factor authentication enabled, including an administrator account, to skip the password step and brute-force the second-factor code to log in as that user. This only affects sites with the Front End Login module enabled and the WP 2FA plugin active.

## References

- https://wpsec.com/vuln/WPSEC-2026-2152/
- https://plugins.svn.wordpress.org/uncanny-learndash-toolkit/tags/3.8.3/
- https://wordpress.org/plugins/uncanny-learndash-toolkit/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2152/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.