CVE-2026-65555: Uncanny Toolkit for LearnDash up to 3.8.2 lets a low-privilege account become an administrator

Summary

Uncanny Toolkit for LearnDash, a WordPress plugin, is affected by an incorrect privilege assignment in all versions through 3.8.2 that allows privilege escalation. Patchstack rates the issue 9.8 critical and says a low-privilege user can become an administrator with full control of the site, and that it expects the flaw to be exploited in mass campaigns. Version 3.8.3 contains the fix and should be applied immediately. Patchstack also states that no virtual-patching or mitigation rule can be written for this bug, so updating is the only reliable protection.

Remediation

Update Uncanny Toolkit for LearnDash to 3.8.3 or later immediately.
If you cannot update right away, ask your host or a developer for help and consider deactivating the plugin until the update can be applied.
Do not rely on a WAF or virtual patching to block this issue, because Patchstack states no mitigation or virtual-patching rule can address it.
After updating, review your administrator accounts and recent role changes for anything you did not make, since successful exploitation grants admin access.
Add the plugin to your routine update process so that future security releases are applied without manual tracking.

Root cause

The vulnerability is an incorrect privilege assignment (CWE-266) that leads to privilege escalation: a handler that should be restricted to administrators can be reached with insufficient capability checks, so a low-privilege account can perform a privileged action. The patch adds a manage_options capability check to the support-form handler Boot::uo_admin_help_process() in src/boot.php, aligning it with the capability used by the Help page. Note that the available sources do not name the exact function or endpoint that serves as the privilege-escalation vector, so the precise path an attacker takes is not documented here.

The fix

Version 3.8.3 adds a manage_options capability check to the support-form handler Boot::uo_admin_help_process() in src/boot.php, matching the capability the Help page already uses, and hardens that handler's request handling with isset() checks plus wp_unslash() and sanitizing/escaping before values are used. The same release reworks the 2FA code-submission flow in src/includes/two-factor/providers/wp-2fa/class-authentication-handler.php so a login nonce must be supplied and is consumed exactly once, making the challenge single-use; a new complete_login() helper checks the WP 2FA lockout state, reserves an attempt before validating a code, counts failed attempts, and ends the challenge when attempts are exhausted or the account is locked. Request-parameter handling in src/includes/two-factor/providers/core/class-integration.php (wp-auth-id, nonce, provider, redirect_to) also changed. The release is a large patch — 385 changed hunks between 3.8.2 and 3.8.3 — and the sources do not make clear whether the 2FA changes are part of this CVE's fix or separate hardening shipped at the same time.

Attack preconditions

User interaction: not required
The advisory describes the attacker as a low-privilege user, which implies an account on the target site is needed, but no source states which role is sufficient (subscriber, contributor or another level), and the CVSS vector itself is scored as PR:N (no privileges required). Treat any site that allows untrusted accounts — for example open registration or third-party contributor accounts — as exposed until the exact required role is documented.

Impact

A low-privilege user can escalate to administrator and gain full control of the site, including the ability to install plugins and themes, create additional administrators and take over content. Patchstack expects the vulnerability to be exploited and notes that this class of bug is used in mass-exploit campaigns that hit sites regardless of size or popularity, and it states that no virtual-patching rule can be assigned to this flaw.

Am I affected?

If you run Uncanny Toolkit for LearnDash at version 3.8.2 or earlier, your site is affected.
Check the installed version on the Plugins screen or with wp plugin get uncanny-learndash-toolkit --field=version and compare it against 3.8.3.
If your site allows untrusted accounts, such as open registration or external contributors, assume the exposure is real because the flaw is reachable by a low-privilege user.
If you cannot confirm which account role is required, treat any authenticated account on the site as potentially sufficient until you update.
Running a firewall or virtual-patching layer does not remove the risk, because Patchstack states no mitigation rule can be assigned to this vulnerability.

Exploits & detection

No public PoC or detection template found yet.

Timeline

Published: 04 Nov 2026
Last modified upstream: 04 Nov 2026
VulnCrest analysis published: 05 Nov 2026

Sources & licenses

CVE / CVSS / CWE

NVD record ↗ (unmodified). This product uses the NVD API but is not endorsed or certified by the NVD. CVE® © The MITRE Corporation.

Exploitation

CISA KEV (CC0) · EPSS by FIRST.org

References used for the analysis

Analysis, summary and remediation

View JSON