Unrated severityNVD Advisory· Published Oct 21, 2026
CVE-2026-107127
CVE-2026-107127
Description
The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not validate the origin of a password-reset request, allowing an unauthenticated attacker to set the password of a user who is partway through a password reset to an attacker-chosen value through a forged request, resulting in full account takeover.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <3.8.2
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.