Uncanny Toolkit for LearnDash Authentication Bypass Vulnerability

The Uncanny Toolkit for LearnDash plugin for WordPress is vulnerable to an Authentication Bypass in versions up to and including 3.8.2.

The flaw exists in the uo_login_action() function via the email parameter. A parser-differential issue causes the plugin's account-verification gate to resolve the submitted email using the raw unsanitized string passed to get_user_by(), while the later wp_signon() call uses WordPress core's sanitize_user() to strip appended junk characters. This lets the gate lookup fail and be skipped while the real account is still resolved and authenticated.

• Affects versions up to and including 3.8.2
• Allows unauthenticated attackers to log in to unverified or administrator-suspended accounts whose credentials they already possess
• Results in a valid wordpress_logged_in session cookie, defeating account-approval and account-suspension controls
• The required nonce is freely obtainable from the unauthenticated ult-refresh-nonce endpoint, making exploitation trivial