PT-2026-23651 · WordPress · Powerpack For Learndash

Khaled Alenazi · Publicado 2026-03-06 · Atualizado 2026-03-17 · CVE-2026-2446

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PowerPack for LearnDash WordPress plugin versions prior to 1.3.0

Description The PowerPack for LearnDash WordPress plugin lacks authorization and Cross-Site Request Forgery (CSRF) checks in an AJAX action. This allows unauthenticated users to modify arbitrary WordPress options, such as default role, and create new administrator users.

Recommendations Update the PowerPack for LearnDash WordPress plugin to version 1.3.0 or later.

Exploit

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-2446

Produtos afetados

Powerpack For Learndash

Referências · 9

• 🔥 https://wpscan.com/vulnerability/cbc95cea-e5d4-4874-add6-c8c728b683b7 · Exploit
• https://twitter.com/infoflowcloud/status/2029976853700546779 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-2446 · Nota de Segurança
• https://t.me/cveNotify/154466 · Publicação no Telegram
• https://twitter.com/Brinztech_com/status/2033861216167186922 · Publicação no Twitter
• https://twitter.com/cracbot/status/2031686852336640088 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2029975564501799268 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2030227860859113872 · Publicação no Twitter
• https://t.me/CVEtracker/46561 · Publicação no Telegram