Home / Vulnerability Intelligence / CVE-2026-2446

CVE-2026-2446 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 6, 2026

PowerPack for LearnDash - Broken Access Control

Published: March 6, 2026Updated: March 6, 2026Remote Exploitable

Overview

PowerPack for LearnDash WordPress plugin < 1.3.0 contains a broken access control caused by missing authorization and CSRF checks in an AJAX action, letting unauthenticated attackers update arbitrary options and create admin users.

Severity & Score

Severity: Critical

CVSS Score: 9.8

Impact

Unauthenticated attackers can modify WordPress options and create admin users, leading to full site takeover.

Mitigation

Update to version 1.3.0 or later.

References

https://wpscan.com/vulnerability/cbc95cea-e5d4-4874-add6-c8c728b683b7/

Related Resources

Vulnerability Intelligence Dashboard
Credential Scanner

Details

CVE ID: CVE-2026-2446
Severity: Critical
CVSS Score: 9.8
Type: broken_access_control
Status: new

CWE

CWE-862

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H