Authentication Bypass Vulnerability in Uncanny Toolkit for LearnDash by WordPress

CVE-2026-119096

What is CVE-2026-119096?

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to an authentication bypass due to a flaw in the processing of the 'email' parameter within the uo_login_action() function. When an attacker submits an email, the plugin inadequately handles this input, allowing the account-verification mechanism to be circumvented. This vulnerability arises because the plugin uses an unsanitized string in the get_user_by() function, while subsequent calls to wp_signon() rely on WordPress core's sanitize_user() to handle input properly. As a result, attackers can gain access to accounts, including those that are unverified and administrator-suspended, using only the correct credentials. Additionally, the nonce used for this action can be retrieved without authentication via a publicly accessible endpoint, facilitating exploitation by anyone with knowledge of the target's credentials.

References