CVE-2026-65555

CriticalCVSS 9.8

Published: 04/11/2026(UTC)Updated: 04/11/2026(UTC)Translated: 04/11/2026(UTC)NVD NIST

Summary

The Uncanny Toolkit for LearnDash plugin (through version 3.8.2) contains an incorrect privilege assignment vulnerability that allows privilege escalation. A low-privileged user can gain access to functionality reserved for higher roles.

Risk Assessment

Privilege escalation in WordPress can let an attacker take over the site, modify content, or install malicious code. The risk applies to any installation running the vulnerable plugin version.

Recommendation

Update the Uncanny Toolkit for LearnDash plugin to a version later than 3.8.2. Review user accounts for unexpected privilege changes.

Other vulnerabilities in Uncanny Toolkit for LearnDash

CVE-2026-119096Critical
The Uncanny Toolkit for LearnDash plugin for WordPress (up to 3.8.2) is vulnerable to Authentication Bypass via the 'email' parameter in uo_login_action(). A parser-differential flaw allows skipping account verification by using a raw string for lookup and a sanitized string for login. This lets unauthenticated attackers log in to unverified or suspended accounts if they know the credentials.

Original NVD description (English source)

Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS