CVE-2026-65555 · Runtime
NO FIX YET · SEE WHAT TO DO
Uncanny Toolkit for LearnDash, a WordPress plugin, assigns privileges incorrectly, allowing privilege escalation. A user with low access can gain higher rights on the affected site.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Sites running the Uncanny Toolkit for LearnDash WordPress plugin at version 3.8.2 or earlier are exposed. The sources do not say which roles can trigger the escalation, so the exposure for sites with only trusted administrators is unknown.
Not affected if plugin-not-installed
Who cares learndash, self-hosted, uncanny-toolkit, wordpress
3.8.2, the last affected version in the NVD description3.8.2 (the sources do not name the exact fixed release)Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-65555") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.