CVE-2026-2446

Powerpack for LearnDash < 1.3.0 - Unauthenticated Arbitrary Option Update

CVSS 9.8 CRITICALEPSS 0.3%CWE-862

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.8EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

06 Mar 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Unknown · PowerPack for LearnDash

References

https://wpscan.com/vulnerability/cbc95cea-e5d4-4874-add6-c8c728b683b7/