Uncanny Owl Vulnerabilities and Affected Products
Vulnerabilities associated with Uncanny Groups for LearnDash.
Products
Clear product- Uncanny Toolkit for LearnDash6 vulnerabilities
- Uncanny Automator5 vulnerabilities
- Uncanny Automator Pro4 vulnerabilities
- Uncanny Toolkit Pro for LearnDash3 vulnerabilities
- Uncanny Groups for LearnDash2 vulnerabilities
- Tin Canny Reporting for LearnDash1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Uncanny Groups for LearnDash <= 6.1.0.1 - Missing Authorization to Authenticated (Group Leader+) User Group AddThe Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group leader-level access and above, to add users to their group which ultimately allows them to leverage CVE-2024-8349 and gain admin access to the site. CWE-862Sep 25, 2024 | CVSS2.7v3.1 | EPSS0.427% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2024-8349HIGH | Uncanny Groups for LearnDash <= 6.1.0.1 - Authenticated (Group Leader+) Privilege EscalationThe Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access. CWE-862Sep 25, 2024 | CVSS7.2v3.1 | EPSS1.16% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |