← Database

CVE-2026-2446

CRITICAL CVSS: 9.8 Published: 2026-03-06 Modified: 2026-06-17

Description

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users

Affected Platforms

Unknown

Weakness Type

CWE-862

References