What is the CVSS score of CVE-2026-4314?

CVE-2026-4314 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4314?

The Ultimate WordPress Toolkit plugin contains a critical privilege escalation vulnerability that allows any logged-in user to gain full administrator access and compromise WordPress installations.

How to fix or mitigate CVE-2026-4314?

Within 24 hours: Disable the WP Extended plugin on all WordPress instances and audit administrator accounts for unauthorized creations. Within 7 days: Deactivate and remove the plugin entirely; identify alternative solutions and implement them. Within 30 days: Review access logs for exploitation indicators, reset all credentials, conduct a full security audit of affected WordPress environments, and establish a plugin vetting process to prevent future high-risk deployments.

WordPress CVE-2026-4314

EUVD-2026-14275 HIGH

Improper Privilege Management (CWE-269)

2026-03-22 Wordfence

GHSA-r5jq-wvhc-w6jv

WordPress Privilege Escalation

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 22, 2026 - 03:45 euvd

EUVD-2026-14275

Analysis Generated

Mar 22, 2026 - 03:45 vuln.today

CVE Published

Mar 22, 2026 - 03:26 nvd

HIGH 8.8

DescriptionCVE.org

The 'The Ultimate WordPress Toolkit - WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the isDashboardOrProfileRequest() method in the Menu Editor module using an insecure strpos() check against $_SERVER['REQUEST_URI'] to determine if a request targets the dashboard or profile page. The grantVirtualCaps() method, which is hooked into the user_has_cap filter, grants elevated capabilities including manage_options when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.

AnalysisAI

The Ultimate WordPress Toolkit - WP Extended plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 3.2.4. Authenticated attackers with Subscriber-level access can exploit an insecure URL check to gain administrative capabilities, enabling them to modify WordPress options and create new administrator accounts. This is a critical vulnerability with a CVSS score of 8.8, requiring low attack complexity and no user interaction.

Technical ContextAI

This vulnerability (CWE-269: Improper Privilege Management) exists in the Menu Editor module of the WP Extended plugin, specifically affecting cpe:2.3:a:wpextended:the_ultimate_wordpress_toolkit_–_wp_extended. The flaw stems from the isDashboardOrProfileRequest() method using an insecure strpos() check against the REQUEST_URI server variable to determine if a request targets the dashboard or profile page. When this check returns true, the grantVirtualCaps() method, hooked into WordPress's user_has_cap filter, inappropriately grants elevated capabilities including manage_options. The use of strpos() for security decisions is problematic because it performs simple substring matching without proper validation, allowing attackers to bypass the intended security control by manipulating the URL with crafted query parameters. This represents a fundamental authentication and authorization bypass in the plugin's capability management system.

RemediationAI

Site administrators should immediately upgrade The Ultimate WordPress Toolkit – WP Extended plugin to a version newer than 3.2.4 that contains the security fix, as evidenced by the changeset available at https://plugins.trac.wordpress.org/changeset?old=3475963&old_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php&new=&new_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php. Until patching is complete, administrators should consider temporarily disabling the WP Extended plugin or restricting user registration to prevent creation of new subscriber accounts that could be leveraged for exploitation. Additionally, audit existing user accounts for unexpected privilege escalations and review recent WordPress option changes in the database for unauthorized modifications. Monitor WordPress admin access logs for suspicious URL patterns containing dashboard or profile-related strings in query parameters that may indicate exploitation attempts.