CVE-2026-119096: Authentication Bypass in Uncanny Toolkit

CVE-2026-119096 is an authentication bypass in Uncanny Toolkit for LearnDash plugin up to version 3.8.2. The flaw exploits a parser-differential between two operations: the account-verification check uses the raw, unsanitized email value in user lookup, while the subsequent login call applies WordPress core sanitization. This difference allows bypassing the account-approval gate and accessing unverified or suspended accounts.

CVSS score is 9.8 (critical). The vulnerability was disclosed on October 31, 2026, and is already actively discussed on social networks with emphasis on high priority risk. No patched version status is reported in official data, so an update to a later version must be verified with the vendor. The flaw requires only knowledge of the victim's credentials and the nonce is freely obtainable from the same login request.

For organizations: verify if Uncanny Toolkit plugin is installed and active; if yes, check the version and update immediately if available. Review site access logs to identify unverified or suspended accounts that have logged in recently, a possible sign of exploitation. Implement monitoring on authentication failure logs and access from unapproved accounts. For administrators: consider disabling the plugin until an official patch is available if updates are not in place.