Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-2446

Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
WPScan

Description

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown PowerPack for LearnDash

Default version status: unaffected

  • 0 to < 1.3.0affected

References