CVE-2026-119096: Authentication Bypass in Uncanny Toolkit for LearnDash Lets Attackers Get Past Account Approval and Suspension

A critical (CVSS 9.8) authentication bypass in the Uncanny Toolkit for LearnDash WordPress plugin, versions 3.8.2 and earlier, lets unauthenticated attackers log in to unverified or suspended accounts if they already have the account's credentials.

What Is It

CVE-2026-119096 (CWE-287, Improper Authentication) is in the plugin's uo_login_action() function and is triggered through its email parameter. The bug comes from two parts of the login flow reading the same input differently. The plugin's account-verification gate looks up the submitted email value as a raw, unsanitized string using get_user_by(). The wp_signon() call that follows uses WordPress core's internal sanitize_user(), which strips appended junk characters.

If an attacker adds junk characters to the email, the gate lookup fails and the check is skipped entirely. WordPress still resolves the real account and authenticates it. The handler needs a nonce, but the unauthenticated ult-refresh-nonce endpoint hands one out in the same request.

Why It Matters

• Score: CVSS 3.1 base score of 9.8 (CRITICAL). The vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: network-reachable, low complexity, and no privileges or user interaction required.
• Result: An attacker gets a valid wordpress_logged_in session cookie. This defeats the plugin's account-approval and account-suspension controls.
• Who can exploit it: NVD calls exploitation "trivial" for anyone who can reach the site over the network and knows a target account's credentials. Accounts that an administrator suspended or never approved can still be used.
• Exploitation status: The supplied CISA KEV entry is empty, so KEV does not currently confirm active exploitation of this CVE.

What's Vulnerable

• Vendor: uncannyowl
• Product: Uncanny Toolkit for LearnDash (WordPress plugin)
• Affected versions: all versions up to and including 3.8.2
• NVD status: "Received", published 2026-10-31

NVD does not list any affected CPEs.

Patch Status

The NVD record does not name a fixed version. Wordfence's references include a WordPress plugin changeset (3773997) to frontend-login-plus.php in the plugin's trunk, which suggests a code fix is underway or has been committed. There is no CISA KEV required action or due date because the KEV entry is empty.

Administrators running version 3.8.2 or earlier should: - Watch the vendor and Wordfence advisories for a release confirmed as fixed, and update when it ships. - Review accounts that are suspended or still awaiting approval, since those are the ones this bypass exposes.

Sources

• NVD: CVE-2026-119096
• Wordfence Threat Intel advisory
• WordPress Plugin Trac: changeset 3773997 (frontend-login-plus.php)
• WordPress Plugin Trac: vulnerable code, v3.8.2 (L3357)
• WordPress Plugin Trac: vulnerable code, v3.8.2 (L3446)
• WordPress Plugin Trac: vulnerable code, v3.8.2 (L3527)
• WordPress Plugin Trac: vulnerable code, v3.8.2 (L3559)