Uncanny Toolkit CVE-2026-107127

Exploitation requires that a target user be PARTWAY THROUGH a password-reset flow at the moment of attack - the forged request hijacks an already-initiated reset rather than starting one arbitrarily, which is the core limiting prerequisite. It further requires victim interaction (UI:R): the user must be induced to trigger the attacker's cross-site forged request (e.g., visiting a malicious page or clicking a crafted link), making social engineering a practical dependency. The underlying flaw is the plugin's failure to validate the origin of the password-reset request (no anti-CSRF origin/token check). No authentication is needed (PR:N), and the affected flow is reachable over the network against sites running Uncanny Toolkit for LearnDash before 3.8.2. The timing window plus required user interaction are the main factors that constrain realistic exploitation below the raw 7.5 score.

This is a genuine but conditional priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) describes a network-reachable, unauthenticated CSRF (CWE-352) that yields full account takeover, but two metrics temper real-world risk: AC:H and UI:R. Exploitation is not point-and-shoot - it requires both a victim who is mid-way through a password-reset flow (a timing window) and victim interaction with the attacker's forged request, which is why the complexity is High rather than Low. Publicly available exploit code exists (per WPScan), raising the practical likelihood of opportunistic abuse, but the vulnerability is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. Net: treat as a prioritized patch for sites running the affected plugin, but the AC:H/UI:R gating means this favors targeted social-engineering-assisted attacks over mass automated exploitation - contrast with a PR:N/AC:L/UI:N flaw, which would warrant emergency response.

An attacker initiates or waits for a target user to begin a password reset on a site running a vulnerable Uncanny Toolkit for LearnDash build, then lures that user (e.g., via a crafted link or malicious page) into triggering a forged cross-site request that sets the in-progress reset to an attacker-chosen password. Because the plugin does not validate the origin of the reset request, the attacker gains full control of the victim's account. A public proof-of-concept exists (WPScan), lowering the skill needed, though the attack still depends on catching the victim during an active reset and on user interaction.