CVE-2026-107128 in Uncanny Toolkit for LearnDash Plugin
Summary
by MITRE • 10/21/2026
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified within versions of the Uncanny Toolkit for LearnDash WordPress plugin prior to version 3.8.2 represents a critical failure in access control mechanisms, specifically manifesting as an Insecure Direct Object Reference combined with insufficient authorization checks on a multisite network environment. This flaw allows authenticated users who hold the role of subsite administrator to manipulate user account states beyond their designated scope of authority. The core technical deficiency lies in the plugin's handling of user verification status updates, where the system fails to validate whether the initiating request originates from an entity with legitimate administrative privileges over the specific target user account residing on a different site within the same WordPress multisite network.
In a standard WordPress multisite architecture, permissions are typically segmented by site boundaries, meaning that administrators for one subsite should not possess control over users registered or managed on other distinct subsites unless explicitly granted cross-site capabilities. However, due to this authorization bypass, an attacker with valid credentials as a subsite administrator can exploit the unverified user management functionality to target arbitrary network-wide accounts. By submitting crafted requests that specify the unique identifiers of users outside their own site's domain, the malicious actor can force these external accounts into an unverified state without any legitimate justification or permission from the main network super-administrator or the respective subsite administrators where those users belong.
The operational impact of this vulnerability is severe and directly affects user availability and authentication integrity. When a target account is marked as unverified, WordPress typically enforces a restriction that prevents such accounts from logging into the system until their email address is confirmed through a verification link sent to them. Consequently, an attacker can effectively perform a denial-of-service attack against specific individuals or groups by locking them out of their accounts indefinitely if they do not have access to the original registration email for re-verification. This capability undermines trust in the platform's security model and allows for targeted harassment or disruption of services provided through LearnDash courses and other plugin-dependent features that require verified user status.
From a classification perspective, this vulnerability aligns with CWE-269, which describes Improper Privilege Control, as it involves an actor elevating their effective privileges to perform actions reserved for higher-level administrators across site boundaries. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is indicative of T1078, Valid Accounts, where legitimate credentials are abused to gain unauthorized access or modify system state, and potentially relates to T1496, Resource Hijacking, if used to disrupt service availability for specific users. The lack of server-side validation regarding the relationship between the acting user's site context and the target user's assigned site constitutes a fundamental breach in security architecture principles designed to maintain isolation within multi-tenant environments.
Mitigation strategies must prioritize immediate patching as the primary defense vector, requiring administrators to upgrade the Uncanny Toolkit for LearnDash plugin to version 3.8.2 or later where these authorization checks have been corrected. In scenarios where upgrading is not immediately feasible due to compatibility constraints with other plugins or custom code modifications, temporary workarounds should be implemented at the web application firewall level to block suspicious requests that attempt to modify user verification statuses for accounts outside the requester's subsite context. Additionally, enforcing strict role-based access control policies and auditing administrative actions can help detect such abuse attempts early. It is also advisable to review network-wide user management practices to ensure that only trusted super-administrators have the ability to manage cross-site user states, thereby reducing the attack surface available to lower-privileged subsite administrators.