Uncanny Toolkit For Learndash
Monthly
Authentication bypass in Uncanny LearnDash Toolkit 3.8.2 and earlier lets a network attacker who already knows a target account's credentials log in even when that account is pending approval, unverified, or administrator-suspended. The plugin's account gate checks the raw `email` value with `get_user_by()`, while the later `wp_signon()` call runs WordPress core's `sanitize_user()`, so appended junk causes the gate to be skipped while the real account still authenticates; the required nonce is freely obtainable from the unauthenticated `ult-refresh-nonce` endpoint. Risk signals are mixed: the supplied vector is 9.8 with PR:N and the decision label is act_now, but exploitation still requires valid credentials for an account in a gated state; no public exploit identified at time of analysis.
Account takeover is possible in Uncanny Toolkit for LearnDash (WordPress plugin) before 3.8.2: the plugin's password-reset handler accepts forged cross-site requests without validating their origin, so an unauthenticated attacker who induces a victim - one who is already partway through a reset - into loading a crafted page can set that account's password to an attacker-chosen value. Publicly available exploit code exists and the vendor shipped a fix in 3.8.2, though exploitation is gated by the timing of an in-progress reset plus victim interaction (CVSS 7.5, AC:H/UI:R).
Broken authorization in the Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 lets a subsite administrator on a multisite network flip arbitrary network users outside their own site to an 'unverified' state, locking those accounts out of the site. The flaw only manifests on WordPress multisite installs - default single-site deployments are not affected - and requires the attacker to already hold elevated subsite-admin privileges, so realistic exposure is confined to insider or compromised-admin privilege abuse rather than remote anonymous attack. Publicly available exploit code exists and a vendor fix (3.8.2) is released; there is no confidentiality exposure or code execution, only a targeted denial of login service.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.6.4.3. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Authentication bypass in Uncanny LearnDash Toolkit 3.8.2 and earlier lets a network attacker who already knows a target account's credentials log in even when that account is pending approval, unverified, or administrator-suspended. The plugin's account gate checks the raw `email` value with `get_user_by()`, while the later `wp_signon()` call runs WordPress core's `sanitize_user()`, so appended junk causes the gate to be skipped while the real account still authenticates; the required nonce is freely obtainable from the unauthenticated `ult-refresh-nonce` endpoint. Risk signals are mixed: the supplied vector is 9.8 with PR:N and the decision label is act_now, but exploitation still requires valid credentials for an account in a gated state; no public exploit identified at time of analysis.
Account takeover is possible in Uncanny Toolkit for LearnDash (WordPress plugin) before 3.8.2: the plugin's password-reset handler accepts forged cross-site requests without validating their origin, so an unauthenticated attacker who induces a victim - one who is already partway through a reset - into loading a crafted page can set that account's password to an attacker-chosen value. Publicly available exploit code exists and the vendor shipped a fix in 3.8.2, though exploitation is gated by the timing of an in-progress reset plus victim interaction (CVSS 7.5, AC:H/UI:R).
Broken authorization in the Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 lets a subsite administrator on a multisite network flip arbitrary network users outside their own site to an 'unverified' state, locking those accounts out of the site. The flaw only manifests on WordPress multisite installs - default single-site deployments are not affected - and requires the attacker to already hold elevated subsite-admin privileges, so realistic exposure is confined to insider or compromised-admin privilege abuse rather than remote anonymous attack. Publicly available exploit code exists and a vendor fix (3.8.2) is released; there is no confidentiality exposure or code execution, only a targeted denial of login service.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash.6.4.3. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Request Forgery (CSRF) vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash plugin <= 3.6.4.1 versions. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.