Uncanny Toolkit for LearnDash CVE-2026-107128

Exploitation requires a WordPress MULTISITE network deployment (default single-site WordPress is not affected) running Uncanny Toolkit for LearnDash before 3.8.2, AND the attacker must already hold subsite-administrator privileges on at least one site in that network (PR:H). The only action available is changing other users' verification state to deny their logins - there is no confidentiality exposure or code execution. Limiting factors: the high privilege requirement (must be a trusted-but-malicious or compromised subsite admin), the multisite-specific configuration, and the version ceiling (<3.8.2) all substantially narrow real-world exploitability to insider/privilege-abuse scenarios.

This is a medium-severity broken-authorization flaw (CWE-863), not a critical one, and the signals are internally consistent on that point. The input CVSS of 5.0 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H) describes a network-reachable but high-privilege, high-complexity issue: the attacker must already hold subsite administrator rights on a WordPress multisite network, so PR:H is the dominant risk-limiting factor. No EPSS score was provided and the CVE is NOT on CISA KEV, so there is no evidence of widespread or automated exploitation; the only active-exploitation-adjacent signal is that publicly available exploit code exists (per WPScan), which is distinct from in-the-wild use. The practical impact is a targeted denial-of-service - flipping other network users' verification state to lock them out of login - rather than data theft or code execution (C:N). I disagree with the input's A:H: locking out specific targeted accounts is better characterized as partial availability loss (A:L), since it does not take down the whole system. Net: a real but bounded insider/privilege-abuse issue for multisite operators, not an emergency internet-facing vulnerability. Vendor is listed as 'unknown' in the CPE, which is a metadata gap, not a security finding.

On a WordPress multisite network, a user with only subsite-administrator rights on one site invokes the plugin's verification-management function against user accounts belonging to other sites in the network. Because the plugin never checks that the acting admin is authorized over those target accounts, the attacker marks them 'unverified,' blocking their logins network-wide. Public exploit code for this issue is available from WPScan, lowering the effort for a malicious or compromised subsite admin.