CVE-2024-8349
Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege Escalation
CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th
The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access.
| CWE | CWE-862 |
| Vendor | uncanny owl |
| Product | uncanny groups for learndash |
| Published | Sep 25, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for uncanny owl uncanny groups for learndash
Be the first to know when new high vulnerabilities affecting uncanny owl uncanny groups for learndash are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Uncanny Owl / Uncanny Groups for LearnDash
0 ≤ 6.1.0.1
References
Credits
Karl Emil Nikka