IT SBIT Services
Schneeberger
DEEN
CVE tracker

Uncanny Toolkit for LearnDash: Authentication bypass in login via email parameter

CVE-2026-119096Critical 9.8

← All vulnerabilities

Summary

The Uncanny Toolkit for LearnDash WordPress plugin up to and including version 3.8.2 contains an authentication bypass in its front-end login handler. A parser difference between the plugin's account-verification check and WordPress's login function causes the verification to be skipped. An unauthenticated attacker who knows the credentials of an unverified or administrator-suspended account can log in and obtain a valid session, bypassing the plugin's approval and suspension controls.

Affected

  • Uncanny Toolkit for LearnDash versions up to and including 3.8.2
  • Affected function: uo_login_action() via the 'email' parameter

Fixed in

Unknown.

Workaround

  • No vendor-published workaround confirmed.
  • If the front-end login module is not needed, disable it.
  • Restrict or rate-limit access to login endpoints where feasible.

Exploitation

  • Attack requires network access to the site and valid credentials for the target account.
  • The required nonce is obtainable without authentication from the ult-refresh-nonce endpoint.
  • Exploited in the wild: Unknown.
  • Public proof of concept: Unknown.

Our recommendation

  • Check whether the front-end login module of the plugin is in use and disable it if not needed.
  • Review unverified and suspended accounts and check for unexpected logins and active sessions.
  • Force password resets for affected accounts if misuse is suspected.
  • Monitor the Wordfence and WordPress.org pages and update to a fixed version as soon as one is released.
  • Do not assume version 3.8.2 is safe.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:20.

Original description (NVD)

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.

NVD references (6)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed