CVE-2026-107128
Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
| Vendor | unknown |
| Product | uncanny toolkit for learndash |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown uncanny toolkit for learndash
Be the first to know when new unknown vulnerabilities affecting unknown uncanny toolkit for learndash are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Uncanny Toolkit for LearnDash
0 < 3.8.2
References
Credits
Muni Nitish Kumar Yaddala WPScan