The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
ReviewUncanny Toolkit for LearnDashCVE published 2026-10-21
CVE-2026-107127 is a vulnerability in the Uncanny Toolkit for LearnDash WordPress plugin before version 3.8.2. The plugin does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
