CVE-2026-107128
Deferred Deferred - Pending Action

Unverified User Account State Change in Uncanny Toolkit for LearnDash

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-107128
EUVD
EUVD-2026-107059

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Uncanny Toolkit for LearnDash 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Uncanny Toolkit for LearnDash WordPress plugin before version 3.8.2. It allows a subsite administrator on a multisite network to mark any user outside their own site as unverified without proper authorization checks. This prevents those users from logging in by altering their verification status.

Detection Guidance

Check the installed version of the Uncanny Toolkit for LearnDash plugin. If it is below 3.8.2, the system is vulnerable. Use WordPress admin panel or run: wp plugin list | grep uncanny-toolkit-for-learndash in the WordPress directory.

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to lock out legitimate users from logging into a WordPress multisite network. This could disrupt access for users outside the subsite of the attacker, leading to service disruptions and potential loss of functionality.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized users to lock out legitimate users from accessing systems. For GDPR, unauthorized access restrictions may interfere with user rights to access personal data. For HIPAA, account lockouts could disrupt access to protected health information, affecting availability requirements.

Mitigation Strategies

Update the Uncanny Toolkit for LearnDash plugin to version 3.8.2 or later immediately. Remove or disable the plugin if an update is not possible. Review user verification statuses for unauthorized changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-107128. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...