CVE-2026-107127: CWE-352 Cross-Site Request Forgery (CSRF) in Uncanny Toolkit for LearnDash
Description
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
CVSS v3.1
Score 7.5high
Affected software
Uncanny Toolkit for LearnDash
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Uncanny Toolkit for LearnDash WordPress plugin versions prior to 3.8.2 do not validate the origin of password-reset requests. This lack of validation enables an attacker to craft a malicious request that sets the password of a user currently undergoing a password reset to a value chosen by the attacker. This Cross-Site Request Forgery (CWE-352) vulnerability can result in the attacker gaining full control over the victim's account.
Potential Impact
Successful exploitation allows an unauthenticated attacker to take over user accounts by setting new passwords during the password reset process. This compromises user confidentiality and integrity, potentially leading to unauthorized access and control of user accounts.
Mitigation Recommendations
Upgrade the Uncanny Toolkit for LearnDash plugin to version 3.8.2 or later, where this vulnerability has been fixed. No other mitigation is indicated or required according to the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-10-07T07:50:28.731Z
- State
- PUBLISHED
Threat ID: 6ad855da2cdf04f656afe40f
Added to database: 10/21/2026, 06:04:10 UTC
Last enriched: 10/21/2026, 06:48:43 UTC
Last updated: 10/21/2026, 13:40:20 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.