{"id":"CVE-2026-107128","published":"2026-10-21T06:16:46.793","lastModified":"2026-10-21T18:37:38.700","description":"The Uncanny Toolkit for LearnDash WordPress plugin before 3.8.2 does not verify that the acting user is permitted to manage the targeted accounts before changing their verification state, allowing a subsite administrator on a multisite network to mark arbitrary network users outside their own site as unverified and prevent those users from logging in.","cvssScore":5,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:H","cwes":["CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/970ca143-4685-484f-96f4-7d5ba5955a2b/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}