CVE-2026-2446

Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update

CVSS 9.8 CRITICALEPSS 0.3%CWE-862

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Produtos afetados

Unknown · PowerPack for LearnDash

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://wpscan.com/vulnerability/cbc95cea-e5d4-4874-add6-c8c728b683b7/