---
id: "CVE-2026-107128"
kind: "vulnerability"
aliases: ["CVE-2026-107128"]
title: "WordPress LearnDash toolkit: subsite admin can lock out network users"
severity: "medium"
cvss: 5.0
epss: 0.00221
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["learndash", "package", "wordpress", "wordpress-multisite"]
not_affected_if: ["plugin-updated", "single-site"]
published_at: "2026-10-21T06:16:46+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:29:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107128", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107128", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# WordPress LearnDash toolkit: subsite admin can lock out network users

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not check whether the acting user may manage the accounts it changes. A subsite administrator on a WordPress multisite network can mark users outside their own site as unverified, which blocks those users from logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Uncanny Toolkit for LearnDash plugin in the WordPress admin plugins list; versions below `3.8.2` are affected.
- Confirm the site runs WordPress multisite with more than one subsite.

## Fix

- Update the Uncanny Toolkit for LearnDash plugin to `3.8.2` or later.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107128
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107128

## From the sources

The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_