CVE-2026-119096: Uncanny Toolkit for LearnDash — Critical Authentication Bypass

Executive Summary

A critical authentication bypass has been disclosed in the Uncanny Toolkit for LearnDash plugin for WordPress. Tracked as CVE-2026-119096 with a CVSS 3.1 score of 9.8, the flaw affects all versions up to and including 3.8.2 and lives in the uo_login_action() function's handling of the email parameter.

The plugin's account-verification gate evaluates the raw email value, while WordPress's wp_signon() sanitizes the same value before looking up the user. This parser differential lets the verification check be skipped while the login still resolves to a real account. An unauthenticated attacker holding valid credentials can then sign in to accounts that should have been blocked, such as unverified accounts or accounts an administrator suspended, and receive a wordpress_logged_in session cookie.

CVSS Score: 9.8 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Overview

Root Cause

uo_login_action() in src/classes/frontend-login-plus.php checks whether an account is verified or suspended using the email string exactly as submitted. wp_signon() then normalizes that string before resolving the user. A crafted email value that fails to match during the plugin's check but normalizes to a legitimate address passes through the gate and authenticates the real account.

The required nonce is exposed by the unauthenticated ult-refresh-nonce endpoint, so no prior session is needed to submit the login request.

Impact

• Suspended accounts regain access, undermining administrative enforcement
• Unverified accounts bypass email verification, which matters for sites that gate course content or paid access on verification
• Where the attacker knows or has obtained a valid password (for example from credential stuffing), the control that is meant to stop use of that account is defeated

The flaw does not by itself hand over administrator access without valid credentials, but it removes a safeguard that many LMS sites rely on and is easy to chain with leaked-credential lists. I found no confirmed in-the-wild exploitation at the time of writing.

Remediation

Immediate Steps

1. Update Uncanny Toolkit for LearnDash to a version newer than 3.8.2 (a fix was committed to the plugin's trunk in frontend-login-plus.php)
2. If no fixed release is available to you: disable the plugin's frontend login module or deactivate the plugin
3. Review authentication logs for logins to accounts that were suspended or never verified
4. Reset passwords and invalidate sessions for any account showing unexpected logins

Hardening

• Enforce MFA for all privileged and instructor accounts
• Rate-limit and monitor requests to the ult-refresh-nonce endpoint and the plugin's login action
• Use a WAF rule to flag login requests where the email field contains unusual encoding or whitespace characters

Detection

Key Takeaways

1. CVSS 9.8 Critical — authentication bypass in a popular LMS add-on
2. All versions up to 3.8.2 are affected
3. The root cause is a validate-raw, authenticate-sanitized mismatch, a recurring pattern in login code
4. Update promptly and review accounts that were meant to be blocked

References

• NVD — CVE-2026-119096
• Wordfence Threat Intelligence entry
• Plugin source — fix changeset