CVE-2026-119096
Received Received - Intake

Authentication Bypass in Uncanny Toolkit for LearnDash

Publication date: 2026-10-31

Last updated on: 2026-10-31

Assigner: Wordfence

Description
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-31
Last Modified
2026-10-31
Generated
2026-10-31
AI Q&A
2026-10-31
EPSS Evaluated
N/A
NVD
CVE-2026-119096
EUVD
EUVD-2026-114649

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
uncannyowl Uncanny Toolkit for LearnDash 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Uncanny Toolkit for LearnDash plugin for WordPress has an authentication bypass flaw in versions up to 3.8.2. The vulnerability occurs because the plugin checks an email parameter unsanitized while WordPress sanitizes it later. This mismatch allows attackers to log in to accounts they already have credentials for, bypassing approval or suspension controls.

Detection Guidance

Check if the Uncanny Toolkit for LearnDash plugin is installed and its version is up to 3.8.2. Look for unauthorized login attempts or successful logins to unverified accounts. Review server logs for requests to the `uo_login_action()` function with unsanitized email parameters.

Impact Analysis

Attackers can gain unauthorized access to WordPress accounts with valid credentials, including admin or suspended accounts. This allows them to take control of the site, steal data, or perform malicious actions while bypassing security controls.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Update the Uncanny Toolkit for LearnDash plugin to the latest version beyond 3.8.2. Disable the plugin temporarily if an update is unavailable. Implement additional authentication layers for sensitive accounts and monitor for suspicious login activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119096. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart