Uncanny Owl Uncanny Toolkit for LearnDash Plugin up to 3.8.2 on WordPress Account Verification uo_login_action email improper authentication

Summaryinfo

A vulnerability marked as critical has been reported in Uncanny Owl Uncanny Toolkit for LearnDash Plugin up to 3.8.2. Affected by this vulnerability is the function uo_login_action of the component Account Verification. This manipulation of the argument email causes improper authentication. This vulnerability is tracked as CVE-2026-119096. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical was found in Uncanny Owl Uncanny Toolkit for LearnDash Plugin up to 3.8.2. Affected by this vulnerability is the function uo_login_action of the component Account Verification. The manipulation of the argument email with an unknown input leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.

The advisory is shared at wordfence.com. This vulnerability is known as CVE-2026-119096 since 10/29/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/31/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• Uncanny Owl

Name

• Uncanny Toolkit for LearnDash Plugin

Version

• 3.8.0
• 3.8.1
• 3.8.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion