PT-2026-120453

CVE-2026-107127

Published

2026-10-21

Updated

2026-10-21

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Uncanny Toolkit for LearnDash versions prior to 3.8.2

Description An issue exists where the software fails to validate the origin of password-reset requests. This allows an unauthenticated attacker to intercept a user who is in the process of resetting their password and set it to a value chosen by the attacker via a forged request, leading to full account takeover.

Recommendations Update to version 3.8.2 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ryan Fabella

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers