CVE-2026-119096
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
The Uncanny Toolkit for LearnDash plugin for WordPress (up to 3.8.2) is vulnerable to Authentication Bypass via the 'email' parameter in uo_login_action(). A parser-differential flaw allows skipping account verification by using a raw string for lookup and a sanitized string for login. This lets unauthenticated attackers log in to unverified or suspended accounts if they know the credentials.
Risk Assessment
An attacker can obtain a valid session for an administrative or other privileged account that is unverified or suspended, bypassing the plugin's account approval and suspension controls. This poses a serious risk to site security.
Recommendation
Update the plugin to a version later than 3.8.2 that fixes this vulnerability. Until then, consider disabling the plugin or restricting access to the login endpoint.
Related vulnerabilities
- CVE-2026-86596Critical
The s2Member plugin for WordPress in versions up to and including 260927 is vulnerable to Remote Code Execution via the 'item_name' parameter. Insufficient sanitization in strip_php_tags_deep() only strips literal '<?' sequences, and a post-interpolation placeholder cleanup reassembles a valid '<?php' opener after the attacker-controlled value has already been embedded in the email template.
- CVE-2026-97718Critical
CVE-2026-97718 is a cross-site request forgery vulnerability in version 14.60 of the Secure Access server. Because of a bypassed security control, an attacker can cause an admin to create an account under their control.
- CVE-2026-116769Critical
CVE-2026-116769 is an authentication bypass vulnerability in Secure Access servers starting with version 13.0 and prior to 14.61. Attackers can modify security settings of a client via the server.
- CVE-2026-102435Critical
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the _getObjAttr function in all versions up to, and including, 3.5.54. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This requires the PDF Generator add-on to be active and a Contact Form 7 form to be configured for PDF generation.
- CVE-2026-105606Critical
The Joomla Custom Tables extension before 3.7.8 allows an unauthenticated attacker to upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory. The stored path is disclosed in the response, and the file is served as static content by default.
- CVE-2026-105604Critical
The Joomla DJ-Classifieds extension before 3.11.3 is vulnerable to an unauthenticated SQL injection in the frontend search.
- CVE-2026-105603Critical
The Joomla DJ-Classifieds extension before 3.11.3 is vulnerable to an unprivileged file upload, leading to full remote code execution (RCE).
- CVE-2026-88811Critical
Missing filtering in the SUSE Rancher Manager meta proxy could cause passed-in Rancher credentials to be leaked to cloud providers. This affects SUSE Rancher 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, and 2.13.0 up to 2.13.11.
- CVE-2026-105769Critical
kaniko before 1.25.20 can send a Microsoft Entra ID (Azure AD) access token for Azure Resource Manager to an attacker-controlled registry host. This is due to an unanchored regular expression in the ACR credential helper that accepts hostnames containing .azurecr.io, .azurecr.cn, .azurecr.de, or .azurecr.us.
- CVE-2026-94290Critical
The SUSE Rancher Fleet controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, an ordinary user could define a cluster in a namespace they control and associate it with administrative credentials for the management cluster, causing the controller to manage the management cluster on that user's behalf with elevated privileges. This affects Fleet 0.16.0–0.16.3, 0.15.0–0.15.8, 0.14.0–0.14.12, 0.13.0–0.13.17 and possibly older versions.
Original NVD description (English source)
The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.8.2 via the `email` parameter of the `uo_login_action()` function. This is due to a parser-differential flaw in which the plugin's account-verification gate resolves the submitted `email` value using the raw, unsanitized string passed to `get_user_by()`, while the subsequent `wp_signon()` call relies on WordPress core's internal `sanitize_user()` to strip appended junk characters — causing the gate lookup to fail and be skipped entirely while the real account is still resolved and authenticated. This makes it possible for unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess, obtaining a valid `wordpress_logged_in` session cookie and defeating the plugin's account-approval and account-suspension controls. The nonce required to reach the handler is freely obtainable in the same request from the unauthenticated `ult-refresh-nonce` endpoint, making exploitation trivial for any attacker with network access to the site and knowledge of a target account's credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS