CVE-2026-2446
Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users
| Vendor | unknown |
| Product | powerpack for learndash |
| Published | Mar 6, 2026 |
| Last Updated | Mar 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown powerpack for learndash
Be the first to know when new critical vulnerabilities affecting unknown powerpack for learndash are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / PowerPack for LearnDash
0 < 1.3.0
References
Credits
Khaled Alenazi (Nxploited) WPScan