CVE-2026-119096— Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

Quick assessment

Affected

uncannyowl Uncanny Toolkit for LearnDash

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 LearnDash 插件"Uncanny Toolkit"在 3.8.2 及更早版本中存在认证绕过漏洞。该漏洞源于函数中的参数处理缺陷：由于解析器差异，插件的账户验证网关使用未经清理的原始字符串调用来解析提交的邮箱值，而随后的调用则依赖 WordPress 核心内部的函数来去除附加的无效字符。这导致网关查找失败并被完全跳过，而真实账户仍能被解析并通过认证。因此，未认证的攻击者若已掌握目标账户的凭据，即可登录未验证或被管理员暂停的账户，获取有效的会话 Cookie，从而绕过插件的

CVSS 9.8 · Critical EPSS 0.46% · P40 Updated Nov 01, 2026

Possible ATT&CK Techniques 2 AI

T1551.001 T1110.001 · Password Guessing

Affected Version Matrix 1

Vendor	Product	Version Range	Status
uncannyowl	Uncanny Toolkit for LearnDash	`≤ 3.8.2`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

Source: CVE Program / CVE List V5

Vulnerability Description

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

认证机制不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
uncannyowl	Uncanny Toolkit for LearnDash	0 ~ 3.8.2	-

II. Public POCs for CVE-2026-119096

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119096

请登录查看更多情报信息。

Other References for CVE-2026-119096 (6)

https://www.cve.org/CVERecord?id=CVE-2026-119096

IV. Related Vulnerabilities

Same product: Uncanny Toolkit for LearnDash

Same vendor: uncannyowl

Same weakness: CWE-287