Zero Radar
← feed
CriticalVulnerabilityCVE-2026-119096updated 31 Oct 2026, 12:29 UTC

Uncanny Toolkit for LearnDash WordPress plugin lets attackers skip login checks

Someone who knows a user's password can log in to that account even when the site has not approved it or has suspended it. No prior login is needed.

Official, 2 sources
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker has passwordTarget account credentials are already known
  2. 2Crafted login requestEmail value includes appended junk characters
  3. 3Verification check skippedRaw email lookup fails, so the approval gate is bypassed
  4. 4Session cookie issuedWordPress strips junk and authenticates the real account
  5. ResultAttacker logs into unverified or suspended account

What happened

The uo_login_action() login handler in the Uncanny Toolkit for LearnDash plugin accepts a crafted email parameter. A mismatch between the plugin's verification lookup and WordPress core's sanitize_user() causes the account-verification check to be skipped, while the login still succeeds.

Why it is dangerous: Attackers with valid credentials can get into unapproved or suspended accounts, including administrator accounts, and defeat the plugin's approval and suspension controls. Any WordPress site running the affected plugin version is exposed.

Are you affected?

You are affected if you run the Uncanny Toolkit for LearnDash WordPress plugin version 3.8.2 or earlier.

Uncanny Toolkit for LearnDash (WordPress plugin), all versions up to and including 3.8.2

What to do

  1. Check whether the Uncanny Toolkit for LearnDash plugin is installed and whether its version is 3.8.2 or earlier
  2. Review the plugin vendor's advisory for a fixed version and update as soon as one is available
  3. Until a fix is confirmed, consider disabling the plugin or restricting access to the WordPress login page
  4. Review unapproved and suspended accounts, and any admin accounts, for unexpected logins

Timeline

  1. 31 Oct 2026, 08:16 UTC
    Publicly disclosed
  2. 31 Oct 2026, 08:16 UTC
    Reported by NVD · NVD
  3. 31 Oct 2026, 08:18 UTC
    Picked up by Zero Radar
  4. 31 Oct 2026, 12:29 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-119096 · GHSA-c7cc-xqvj-xcq2
CVSS
9.8 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
31 Oct 2026, 08:16 UTC
On Zero Radar
31 Oct 2026, 08:18 UTC (2 min after disclosure)
Last change
31 Oct 2026, 12:29 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Uncanny Toolkit for LearnDash WordPress plugin lets attackers skip login checks · Zero Radar