{"id":"CVE-2026-65555","kind":"vulnerability","aliases":["CVE-2026-65555"],"related":[],"title":"Uncanny Toolkit for LearnDash: incorrect privilege assignment lets users escalate rights","description":"Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.","summary":"Uncanny Toolkit for LearnDash, a WordPress plugin, assigns privileges incorrectly, allowing privilege escalation. A user with low access can gain higher rights on the affected site.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["learndash","runtime","self-hosted","uncanny-toolkit","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version of Uncanny Toolkit for LearnDash (uncanny-learndash-toolkit) in the WordPress admin plugins list\n- Compare the installed version against `3.8.2`, the last affected version in the NVD description","fix":"- Uncanny Toolkit for LearnDash: move to a version newer than `3.8.2` (the sources do not name the exact fixed release)","status":"open","published_at":"2026-11-04T13:17:30+00:00","first_seen_at":"2026-11-04T13:27:04+00:00","triaged_at":"2026-11-04T13:27:50+00:00","updated_at":"2026-11-04T13:27:50+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-04T13:27:50Z","model":"claude-haiku-5-5","output":{"fix":"- Uncanny Toolkit for LearnDash: move to a version newer than `3.8.2` (the sources do not name the exact fixed release)","reach":"internet","title":"Uncanny Toolkit for LearnDash: incorrect privilege assignment lets users escalate rights","impact":"high","summary":"Uncanny Toolkit for LearnDash, a WordPress plugin, assigns privileges incorrectly, allowing privilege escalation. A user with low access can gain higher rights on the affected site.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["wordpress","learndash","uncanny-toolkit","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"low-privilege account gains higher site privileges","analyst_note":"Confirm the fixed version and which account role is needed, from the NVD entry or the vendor advisory.","how_to_check":"- Check the installed plugin version of Uncanny Toolkit for LearnDash (uncanny-learndash-toolkit) in the WordPress admin plugins list\n- Compare the installed version against `3.8.2`, the last affected version in the NVD description","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Uncanny Toolkit for LearnDash WordPress plugin at version 3.8.2 or earlier are exposed. The sources do not say which roles can trigger the escalation, so the exposure for sites with only trusted administrators is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000708,"input_tokens":4146,"output_tokens":587,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-65555':14A,17A '3.8.2':80C 'access':44B 'affect':51B,72C 'allow':37B,68C 'assign':7A,34B,55C 'cve':12A,15A 'escal':10A,39B 'escalation.this':70C 'gain':46B 'higher':47B 'host':22B 'incorrect':5A,36B,53C 'issu':71C 'learndash':4A,18B,30B,63C,66C,76C 'let':8A 'low':43B 'n/a':78C 'owl':59C 'plugin':33B 'privileg':6A,35B,38B,54C,69C 'right':11A,48B 'runtim':19B 'self':21B 'self-host':20B 'site':52B 'toolkit':2A,25B,28B,61C,67C,74C 'uncanni':1A,24B,27B,58C,60C,65C,73C 'uncanny-learndash-toolkit':64C 'uncanny-toolkit':23B 'user':9A,41B 'vulner':56C 'wordpress':26B,32B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Uncanny Toolkit for LearnDash WordPress plugin at version 3.8.2 or earlier are exposed. The sources do not say which roles can trigger the escalation, so the exposure for sites with only trusted administrators is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","learndash","runtime","selfhosted","uncannytoolkit","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T13:17:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-65555","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65555","severity":null,"published_at":"2026-11-04T13:17:30+00:00","modified_at":"2026-11-04T13:17:31+00:00","first_seen_at":"2026-11-04T13:27:04+00:00","fetched_at":"2026-11-04T13:27:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}