{"id":"CVE-2026-2446","aliases":["EUVD-2026-10002","GHSA-j6c6-2q86-98m6"],"status":"published","title":"Powerpack for LearnDash \u003c 1.3.0 - Unauthenticated Arbitrary Option Update","description":"The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00442,"percentile":0.38867,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-03-06T06:00:03Z","modified":"2026-06-17T10:30:58Z","products":[{"vendor":"unknown","product":"powerpack for learndash"}],"references":[{"url":"https://wpscan.com/vulnerability/cbc95cea-e5d4-4874-add6-c8c728b683b7/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-2446"},{"url":"https://wpscan.com/vulnerability/cbc95cea-e5d4-4874-add6-c8c728b683b7"},{"url":"https://github.com/advisories/GHSA-j6c6-2q86-98m6"}],"sources":{"cve":[{"id":"CVE-2026-2446","title":"Powerpack for LearnDash \u003c 1.3.0 - Unauthenticated Arbitrary Option Update","description":"The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users","status":"published","published":"2026-03-06T06:00:03.502Z","modified":"2026-03-06T17:46:09.631Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T13:48:35.749498Z"}],"euvd":[{"id":"EUVD-2026-10002","description":"The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users","status":"published","published":"2026-03-06T06:00:03Z","modified":"2026-03-06T17:46:09Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:48:07.686491Z"}],"ghsa":[{"id":"GHSA-j6c6-2q86-98m6","title":"The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF...","description":"The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users","status":"published","published":"2026-03-06T06:30:34Z","modified":"2026-03-06T18:32:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:06:29.785261Z"}],"nvd":[{"id":"CVE-2026-2446","description":"The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users","status":"published","published":"2026-03-06T06:15:57.88Z","modified":"2026-06-17T10:30:58.097Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:08.279852Z"}]}}