What’s Vulnerable › Vulnerabilities

CVE-2026-119096: Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

Description

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.

Summary

CVE-2026-119096 is a critical (CVSS 9.8) unauthenticated authentication bypass in the Uncanny Toolkit for LearnDash WordPress plugin, affecting versions up to and including 3.8.2. A parser-differential flaw in the email parameter of uo_login_action() lets attackers skip the plugin's account-verification gate and log in to unverified or administrator-suspended accounts whose credentials they already hold, defeating account-approval and suspension controls. The required nonce is freely obtainable from the unauthenticated ult-refresh-nonce endpoint, making exploitation trivial for anyone with network access and valid credentials for a target account. It is not listed in CISA KEV, but no fixed version is specified here, so update the plugin as soon as a patched release is available and restrict or monitor access until then.

تُعد CVE-2026-119096 ثغرة تجاوز مصادقة حرجة (CVSS 9.8) في إضافة Uncanny Toolkit for LearnDash لـ WordPress، وتشمل الإصدارات حتى 3.8.2 ضمناً. تكمن المشكلة في خلل تعارض في التحليل بمعامل email ضمن الدالة uo_login_action()، إذ يتيح للمهاجم تخطي بوابة التحقق من الحساب وتسجيل الدخول إلى حسابات غير موثقة أو موقوفة من المسؤول يملك بيانات اعتمادها مسبقاً، مما يبطل ضوابط الموافقة على الحساب وإيقافه. الـ nonce المطلوب متاح مجاناً من نقطة ult-refresh-nonce غير الموثقة، ما يجعل الاستغلال سهلاً لأي مهاجم لديه وصول شبكي ومعرفة ببيانات اعتماد حساب مستهدف. الثغرة غير مدرجة في CISA KEV، ولم يُحدد هنا إصدار مُصلح، لذا يجب تحديث الإضافة فور توفر إصدار مصحح وتقييد الوصول أو مراقبته حتى ذلك الحين.

Affected products

References

Get alerted when CVE-2026-119096 or the next vulnerability affects your stack