CVE-2026-107127
Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
| Vendor | unknown |
| Product | uncanny toolkit for learndash |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown uncanny toolkit for learndash
Be the first to know when new unknown vulnerabilities affecting unknown uncanny toolkit for learndash are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Uncanny Toolkit for LearnDash
0 < 3.8.2
References
Credits
Ryan Fabella WPScan