{"id":"CVE-2026-107128","aliases":["EUVD-2026-107059","GHSA-797j-vc38-j7h4"],"status":"published","title":"Uncanny Toolkit for LearnDash \u003c 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization","description":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.","severity":{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0028,"percentile":0.20749,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2026-10-21T06:00:19Z","modified":"2026-10-21T18:37:38Z","products":[{"vendor":"uncanny owl","product":"uncanny toolkit for learndash"},{"vendor":"unknown","product":"uncanny toolkit for learndash"}],"references":[{"url":"https://wpscan.com/vulnerability/970ca143-4685-484f-96f4-7d5ba5955a2b/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107128"},{"url":"https://wpscan.com/vulnerability/970ca143-4685-484f-96f4-7d5ba5955a2b"},{"url":"https://github.com/advisories/GHSA-797j-vc38-j7h4"}],"sources":{"cve":[{"id":"CVE-2026-107128","title":"Uncanny Toolkit for LearnDash \u003c 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization","description":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.","status":"published","published":"2026-10-21T06:00:19.697Z","modified":"2026-10-21T10:35:05.896Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T13:45:14.072357Z"}],"euvd":[{"id":"EUVD-2026-107059","description":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.","status":"published","published":"2026-10-21T06:00:19Z","modified":"2026-10-21T10:35:05Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"updated_at":"2026-11-02T16:59:39.717973Z"}],"ghsa":[{"id":"GHSA-797j-vc38-j7h4","title":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting...","description":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.","status":"published","published":"2026-10-21T06:31:14Z","modified":"2026-10-21T12:32:11Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:14:09.697532Z"}],"nvd":[{"id":"CVE-2026-107128","description":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.","status":"published","published":"2026-10-21T06:16:46.793Z","modified":"2026-10-21T18:37:38.7Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:13:02.045979Z"}]}}