high7.5
CVE-2026-107127
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker …
Impact
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
Affected products
| Product | Affected versions |
|---|---|
| Uncanny Toolkit For LearnDash WordPress Plugin | before 3.8.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.