CyberSecBulletin

PowerPack for LearnDash vulnerabilities

We track 1 vulnerability in PowerPack for LearnDash products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on March 6, 2026.

1vulnerabilities
1critical
0high
0exploited
9.8average CVSS score

Latest PowerPack for LearnDash vulnerabilities

  • 9.8 Critical severity

    PowerPack for LearnDash: Missing Authorization

    CVE-2026-2446PowerPack for LearnDash

    The PowerPack for LearnDash WordPress plugin before 1.3.0 does not have authorization and CRSF checks in an AJAX action, allowing unauthenticated users to update arbitrary WordPress options (such as default_role etc) and create arbitrary admin users