CVE-2026-107127— Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
Quick assessment
Affected
Unknown Uncanny Toolkit for LearnDash
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
LearnDash WordPress 插件的 Uncanny Toolkit 组件在 3.8.2 版本之前，未对密码重置请求的来源进行验证。这使得未经身份验证的攻击者能够通过伪造请求，将正在执行密码重置流程的用户密码设置为攻击者指定的值，从而导致账户被完全接管。
Possible ATT&CK Techniques 3 AI
T1557 · Adversary-in-the-Middle T1003 · OS Credential Dumping T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Uncanny Toolkit for LearnDash | < 3.8.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-107127
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
Source: CVE Program / CVE List V5
Vulnerability Description
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Uncanny Toolkit for LearnDash | 0 ~ 3.8.2 | - |
|
II. Public POCs for CVE-2026-107127
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-107127
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-21 · 53 CVEs total
| CVE-2026-85683 | 8.8 HIGH | Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL |
| CVE-2026-14556 | 5.4 MEDIUM | HappyForms < 1.26.15 - Unauthenticated HTML Injection in Admin Notification Email via clie |
| CVE-2026-107447 | 5.3 MEDIUM | Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction Bypass via Spoofable Client-IP |
| CVE-2026-105256 | 5.3 MEDIUM | LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'payment_portion' Parameter |
| CVE-2026-104641 | 5.3 MEDIUM | Simple Shopping Cart < 5.3.3 - Unauthenticated Payment Bypass via Unverified PayPal IPN Re |
| CVE-2026-103301 | 5.3 MEDIUM | Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Emp |
| CVE-2026-101138 | 5.3 MEDIUM | CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass |
| CVE-2026-104642 | 2.7 LOW | Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Manipulation via Price Verificatio |
| CVE-2026-105257 | LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR | |
| CVE-2026-110982 | AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title | |
| CVE-2026-107128 | Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Auth | |
| CVE-2026-107788 | SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion | |
| CVE-2026-107790 | WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title | |
| CVE-2026-107789 | SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR | |
| CVE-2026-108073 | SureCart < 4.9.5 - Unauthenticated Private Catalog Data Disclosure via 'expand' Parameter | |
| CVE-2026-109147 | WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter | |
| CVE-2026-109926 | Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation | |
| CVE-2026-110523 | WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registrati | |
| CVE-2026-110514 | WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR | |
| CVE-2026-100145 | Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callbac |
Showing top 20 of 53 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Uncanny Toolkit for LearnDash
-
CVE-2026-107128
Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Ac -
CVE-2025-57988
WordPress Uncanny Toolkit for LearnDash Plugin <= 3.7.0.3 - -
CVE-2025-48080
WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.2 - -
CVE-2025-22268
WordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.1 - -
CVE-2023-34019
WordPress Uncanny Toolkit for LearnDash plugin <= 3.6.4.3 -
Same vendor: Unknown
-
CVE-2026-85683
Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Con -
CVE-2026-14556
HappyForms < 1.26.15 - Unauthenticated HTML Injection in Adm -
CVE-2026-107447
Contest Gallery < 34.0.1 - Unauthenticated Vote Restriction -
CVE-2026-105256
LatePoint < 5.7.5 - Unauthenticated Payment Bypass via 'paym -
CVE-2026-104642
Simple Shopping Cart 5.1.3 - 5.3.2 - Contributor+ Price Mani
V. Comments for CVE-2026-107127
No comments yet