{"id":"CVE-2026-107127","kind":"vulnerability","aliases":["CVE-2026-107127"],"related":[],"title":"Uncanny Toolkit for LearnDash WordPress plugin: forged reset sets any user's password","description":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.","summary":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not check where a password-reset request comes from. An unauthenticated attacker can send a forged request to set the password of a user who is partway through a reset, taking over that account.","severity":"high","cvss":7.5,"epss":0.00134,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["learndash","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get uncanny-learndash-toolkit --field=version`\n- Confirm whether the plugin is active on the site","fix":"- Update the Uncanny Toolkit for LearnDash plugin to `3.8.2` or later\n- Force a password reset for users who reset their password while the site ran a vulnerable version (unknown if the sources list a specific step)","status":"open","published_at":"2026-10-21T06:16:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:17:02+00:00","updated_at":"2026-10-25T03:17:02+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:17:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Uncanny Toolkit for LearnDash plugin to `3.8.2` or later\n- Force a password reset for users who reset their password while the site ran a vulnerable version (unknown if the sources list a specific step)","reach":"internet","title":"Uncanny Toolkit for LearnDash WordPress plugin: forged reset sets any user's password","impact":"high","summary":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not check where a password-reset request comes from. An unauthenticated attacker can send a forged request to set the password of a user who is partway through a reset, taking over that account.","category":"package","nicknames":[],"who_cares":["wordpress","learndash","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over user accounts, including administrators, via forged reset","analyst_note":"Check the plugin's changelog or advisory for version 3.8.2 to confirm the exact fix and whether the flaw needs a reset in progress, and look for any exploitation reports.","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or with `wp plugin get uncanny-learndash-toolkit --field=version`\n- Confirm whether the plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2, typically LearnDash learning sites. The sources do not describe further conditions, so any site running the plugin in that version range should treat itself as exposed. Sites without the plugin installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000646,"input_tokens":3367,"output_tokens":619,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107127':16A,19A '-2026':15A,18A '3.8.2':34B,79C 'account':70B,122C 'allow':91C 'attack':48B,94C,112C 'attacker-chosen':111C 'check':37B 'chosen':113C 'come':44B 'cve':14A,17A 'forg':7A,52B,117C 'full':121C 'host':24B 'learndash':4A,20B,30B,75C 'origin':84C 'packag':21B 'partway':63B,104C 'password':13A,41B,57B,88C,98C,107C 'password-reset':40B,87C 'plugin':6A,32B,77C 'request':43B,53B,90C,118C 'reset':8A,42B,66B,89C,108C 'result':119C 'self':23B 'self-host':22B 'send':50B 'set':9A,55B,96C 'take':67B 'takeov':123C 'toolkit':2A,28B,73C 'unauthent':47B,93C 'uncanni':1A,27B,72C 'user':11A,60B,101C 'valid':82C 'valu':114C 'wordpress':5A,25B,31B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2, typically LearnDash learning sites. The sources do not describe further conditions, so any site running the plugin in that version range should treat itself as exposed. Sites without the plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107127","severity":null,"published_at":"2026-10-21T06:16:46+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107127","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107127","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}