Security Alert Summary
The PowerPack for LearnDash WordPress plugin contains an AJAX action that lacks proper authorization and CRSF checks, which allows unauthenticated users to update arbitrary WordPress options (for example default_role) and create administrative users. Site owners should evaluate exposure and follow recommended mitigations.
CVE Details
- CVE ID: CVE-2026-2446
- Affected plugin or component: PowerPack for LearnDash WordPress plugin
- Affected versions: before 1.3.0 (as stated in the CVE description)
- Published: March 6, 2026 at 6:15:57 AM (UTC)
- Last modified: March 6, 2026 at 6:15:57 AM (UTC)
- CVSS v3.1 base score / severity / vector: Not specified in the CVE entry
- Authentication / privileges / user interaction: Not specified in CVSS data; the CVE description indicates the issue can be triggered by unauthenticated users via an AJAX action lacking authorization and CRSF checks
- Primary impact:
- Confidentiality: Possible exposure or manipulation of site options and user-related settings
- Integrity: Modification of WordPress options (e.g.,
default_role) and creation of arbitrary admin users, allowing unauthorized privilege changes - Availability: Not indicated in the CVE entry as a primary impact
- CWE / weakness ID: Not specified in the CVE entry
Technical Details
According to the CVE description, an AJAX action implemented by the PowerPack for LearnDash plugin does not perform required authorization and CRSF checks. Because these checks are missing, requests sent to that AJAX endpoint can update arbitrary WordPress options and create administrative users without validating the requester.
The vulnerability exists due to absent access control and request validation on the server-side handler for the affected AJAX action. The CVE description specifically notes the ability to change options such as default_role and to create admin users; no specific function names or endpoint paths are provided in the CVE entry.
How This Could Impact Your Website
Consider a small organization running LearnDash with multiple site contributors: the site owner manages subscriptions and training content, internal staff members have editor access for content updates, and an external contractor contributes course materials. If the plugin is present and the site runs an affected version, an unauthenticated attacker could use the vulnerable AJAX action to change site options (for example setting a permissive default_role) or to create a new administrative account.
Practical consequences include unauthorized administrative access, increased exposure of internal user information, and a higher risk of targeted phishing or social engineering against staff. These are realistic, scoped impacts based on the CVE description rather than speculation about full site compromise.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE notes versions before 1.3.0 are affected; a specific fixed version is not specified in the CVE entry.)
- Review and reduce unnecessary user roles, especially contributor-level and higher accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and audit logs for unusual account creation or changes to site options.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
