CVE-2026-2446 — Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update

CVE-2026-2446

Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update PUBLISHED

Description (CNA)

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users

Affected (CNA)

Vendor / product	Versions
Unknown / PowerPack for LearnDash	affected 0 before 1.3.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/cbc95cea-e5d4-4874-add6-c8c728b683b7/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.