CVE-2026-119096

Summary

The Uncanny Toolkit for LearnDash plugin (up to v3.8.2) contains an authentication bypass vulnerability (CWE-287) where the `email` parameter in `uo_login_action()` is parsed inconsistently: the account-verification gate uses the raw email string with `get_user_by()`, while `wp_signon()` later sanitizes it via `sanitize_user()`. This mismatch causes the verification check to fail and be skipped, allowing attackers with valid credentials for unverified or suspended accounts to bypass approval/suspension controls and obtain a logged-in session.

Exploitability

Exploitation is trivial: an attacker needs only network access to the site and knowledge of a target account's credentials; the required nonce is publicly retrievable via the unauthenticated `ult-refresh-nonce` endpoint.

Blast radius

Any unauthenticated attacker with valid credentials for a suspended or unverified account—including administrative accounts—can gain full authenticated access, potentially leading to full site compromise, data exfiltration, or privilege escalation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Uncanny Toolkit for LearnDash version 3.8.3 or later, which resolves the parser-differential flaw by ensuring consistent sanitization and validation of the `email` parameter across both verification and authentication paths.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.