CVE-2026-119096

Name of the Vulnerable Software and Affected Versions Uncanny Toolkit for LearnDash versions prior to 3.8.3

Description An authentication bypass exists due to a parser-differential flaw. The account-verification gate uses the raw email parameter passed to the uo login action() function via get user by(), whereas the wp signon() function uses sanitize user() to remove trailing characters. This discrepancy allows the verification gate to be skipped while the account is still authenticated. Consequently, attackers with valid credentials can access unverified or administrator-suspended accounts and obtain a wordpress logged in session cookie. The required nonce is obtainable through the ult-refresh-nonce endpoint.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.