Password Reset Vulnerability in Uncanny Toolkit for LearnDash by Uncanny Owl
CVE-2026-107127
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 October 2026
Badges
What is CVE-2026-107127?
The Uncanny Toolkit for LearnDash, a WordPress plugin, has a vulnerability that allows unauthenticated attackers to manipulate password-reset requests. This flaw enables attackers to change a user's password without authorization, thereby gaining complete control over the affected account. The issue arises from the plugin's failure to verify the origin of the password reset requests, which creates an opportunity for exploitation. Users are advised to update their Uncanny Toolkit to version 3.8.2 or later to mitigate this risk.
Affected Version(s)
Uncanny Toolkit for LearnDash 0 < 3.8.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.