Uncanny LearnDash Toolkit CVE-2026-119096

Exploitation requires two concrete preconditions, not raw default-config access: (1) the attacker must already possess valid credentials (login identifier and password) for a specific target account, and (2) that account must be in a state the plugin's gate is meant to block - an unverified/pending-approval account or an administrator-suspended account - on a site using the Uncanny Toolkit Frontend Login Plus account-approval/suspension feature. The attack then exploits the parser differential: the raw unsanitized email passed to get_user_by() in the verification gate fails to match (so the gate is skipped), while wp_signon()'s sanitize_user() strips the appended junk and still authenticates the real account. The limiting factors are therefore credential knowledge and the account being in a gated state; the required nonce is NOT a limiter because it is freely obtainable from the unauthenticated ult-refresh-nonce endpoint in the same request. There is no user-interaction or attacker-side authentication requirement (PR:N in the supplied vector).

Signals are mixed in a way worth stating plainly. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical) and the vuln.today 'act_now' decision label both point to high urgency, and the flaw is confirmed by Wordfence (the reporting CNA). However, no EPSS probability, no CISA KEV listing, and no public exploit code are present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the 9.8/act_now rating rests on the vector and ease of triggering, not on observed in-the-wild activity. The most important nuance the raw 9.8 hides: this is not an arbitrary-account takeover. It bypasses only the plugin's account-approval and account-suspension gate, so the attacker must already possess valid credentials for a target account that is unverified or administrator-suspended. Impact is therefore high (full session as that account, including admin if an admin was suspended) but conditional on credential knowledge plus the plugin's gating feature being in use - a real limiter the PR:N score does not capture. Net: a genuine priority for sites running the Uncanny Toolkit login/approval feature, but the 'defeats a security control you already partly bypassed' framing makes it narrower than a classic unauthenticated RCE-grade 9.8.

An attacker who already knows the username/email and password of an account that an administrator has suspended, or that is still pending account approval, targets a site running the Uncanny Toolkit login feature. They fetch a valid nonce from the unauthenticated ult-refresh-nonce endpoint in the same flow, then submit the login with junk characters appended to the email so the plugin's verification gate lookup fails and is skipped while WordPress core still resolves and authenticates the real account. No public exploit code is identified at time of analysis, though the vulnerable source lines and the fix changeset are publicly referenced.