We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-2446

CVE-2026-2446

WordPress

Severity: CRITICAL
CVSS: 9.8CVSS
Published: 2026-03-06
Last modified: 2026-03-09
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-862

Description

The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users

References

https://wpscan.com/vulnerability/cbc95cea-e5d4-4874-add6-c8c728b683b7/

Summary

Description

References