CVE-2026-119096 in Uncanny Toolkit for LearnDash Plugin
Summary
by MITRE • 10/31/2026
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/31/2026
The Uncanny Toolkit for LearnDash plugin version 3.8.2 and earlier contains a critical authentication bypass vulnerability that allows unauthenticated attackers to log in as users who have not yet verified their email addresses or whose accounts have been suspended by administrators. This flaw resides within the `uo_login_action()` function, which handles login requests via the `email` parameter. The root cause of this issue is a parser-differential inconsistency between how the plugin validates account status and how WordPress core processes credentials for authentication. Specifically, when an attacker submits a login request with an email address appended with junk characters, such as spaces or special symbols, the initial verification step uses the raw unsanitized string to query the database via `get_user_by()`. Because this lookup fails due to the malformed input, the plugin incorrectly concludes that no valid account exists and skips its security gates designed to block unverified or suspended users.
However, the subsequent authentication call utilizes WordPress core's `wp_signon()` function, which internally applies the `sanitize_user()` routine before processing credentials. This sanitization step strips away the appended junk characters from the email address, effectively cleaning it up into a valid format that matches an existing user in the database. Consequently, while the plugin’s custom security checks were bypassed due to the initial lookup failure, WordPress core successfully authenticates the legitimate account using the cleaned-up credentials. This discrepancy allows attackers who possess valid credentials for unverified or suspended accounts to obtain a fully functional `wordpress_logged_in` session cookie, thereby circumventing the intended access controls and gaining unauthorized entry into the application environment.
The exploitation of this vulnerability is trivial because it does not require complex payload crafting or out-of-band interactions beyond standard network requests. The nonce required to authenticate the login handler request can be freely obtained from an unauthenticated endpoint named `ult-refresh-nonce` within the same session context. This means that any attacker with basic network access to the WordPress site and knowledge of a target user’s email and password can execute this attack without prior authentication privileges. The impact is significant as it undermines the integrity of account verification workflows, which are often used in educational or membership-based platforms like LearnDash to ensure users meet certain criteria before gaining full access. It also allows attackers to maintain persistent sessions even if administrators have attempted to suspend compromised accounts, leading to potential data exposure and further lateral movement within the system.
From a vulnerability classification perspective, this issue aligns with CWE-287 Improper Authentication, as the application fails to properly verify identity during login attempts due to inconsistent input handling logic. It also relates to CWE-601 URL Redirection to Untrusted Site via Open Redirect if such redirection were involved in session hijacking scenarios, though here it is primarily an authentication bypass. In terms of MITRE ATT&CK framework mapping, this technique falls under T1078 Valid Accounts, where attackers use legitimate credentials that have been compromised or misused due to flawed access control mechanisms. The failure lies not in the strength of the cryptographic hashing but in the logical flow of the application code which fails to enforce state consistency between verification and authentication stages.
Mitigation strategies should focus on immediate patching by updating the Uncanny Toolkit for LearnDash plugin to a version greater than 3.8.2 where this parser-differential flaw has been resolved. Until an update is available, administrators can implement temporary workarounds such as restricting access to the `ult-refresh-nonce` endpoint via web application firewall rules or IP whitelisting if feasible within their infrastructure constraints. Additionally, enforcing strict input validation at the entry point of all login-related functions and ensuring that both verification checks and authentication calls use identical sanitization logic can prevent similar discrepancies in other plugins. Regular security audits focusing on authentication flows are recommended to identify any further logical flaws where state management might be inconsistent across different processing stages.