Live › vulnerability › CVE-2026-107128
Go to dashboardThe Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not check whether the acting user may manage the accounts it changes. A subsite administrator on a WordPress multisite network can mark users outside their own site as unverified, which blocks those users from logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only WordPress multisite networks that run the Uncanny Toolkit for LearnDash plugin before are exposed, and the risk comes from subsite administrators who can reach the plugin's verification feature. Single-site installs are not affected by the cross-site part of this flaw.
3.8.2No product ranges from the sources yet.
3.8.2 are affected.3.8.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.
This page as .md · .json · in your agent: get_signal("CVE-2026-107128")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.