Uncanny Toolkit for LearnDash - Open Redirection

A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security. id: CVE-2023-34020 info: name: Uncanny Toolk...

CVE-2026-119096

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

CVE-2026-119096

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to an Authentication Bypass in versions up to and including 3.8.2 . The issue stems from a parser-differential flaw within the uo_login_action() function's email parameter. While the plugin's account-verification gate uses the r...

CVE-2026-119096 Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

EUVD-2026-114649

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

CVE-2026-119096: uncannyowl Uncanny Toolkit for LearnDash: The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and…

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the email parameter of the uologinaction function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the...

PT-2026-134478

Name of the Vulnerable Software and Affected Versions Uncanny Toolkit for LearnDash versions prior to 3.8.3 Description An authentication bypass exists due to a parser-differential flaw. The account-verification gate uses the raw email parameter passed to the uo login action function via get user...

WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Kuba in WordPress Plugin Uncanny Toolkit for LearnDash versions = 3.8.2...

CVE-2026-107127

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in...

CVE-2026-107128

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...

CVE-2026-107127 Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in...

CVE-2026-107127

The Uncanny Toolkit for LearnDash WordPress plugin (versions before 3.8.2 ) is vulnerable to an account takeover due to a failure to validate the origin of password-reset requests . An unauthenticated attacker can craft a forged request to set the password of a user currently in the middle of a p...

CVE-2026-107127 Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in...

EUVD-2026-107058

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in...

CVE-2026-107128 Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...

CVE-2026-107128 Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...

EUVD-2026-107059

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own sit...

WordPress Uncanny Toolkit for LearnDash plugin < 3.8.2 - Admin+ Cross-Site Account Lockout vulnerability

Admin+ Cross-Site Account Lockout vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Uncanny Toolkit for LearnDash versions 3.8.2...

WordPress Uncanny Toolkit for LearnDash plugin < 3.8.2 - Account Takeover vulnerability

Account Takeover vulnerability discovered by Ryan Fabella in WordPress Plugin Uncanny Toolkit for LearnDash versions 3.8.2...

CVE-2026-107128

The Uncanny Toolkit for LearnDash WordPress plugin (versions before 3.8.2 ) is vulnerable to an Admin+ Cross-Site Account Lockout due to a missing authorization check. Specifically, the plugin fails to verify if an acting user has permission to manage targeted accounts when changing their verific...