EUVD-2026-14275
GHSA-r5jq-wvhc-w6jv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticated user crafts malicious REQUEST_URI
-
Exploitstrpos() check matches dashboard path incorrectly
-
ExecutiongrantVirtualCaps() grants manage_options capability
-
ImpactAttacker executes administrative actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Authenticated WordPress user (any role) accessing 'The Ultimate WordPress Toolkit - WP Extended' plugin versions ≤3.2.4 with Menu Editor module enabled. Attacker crafts malicious REQUEST_URI containing dashboard/profile keywords to bypass insecure strpos() check and gain manage_options capability. |
| Impact | This vulnerability presents a critical real-world risk due to multiple converging factors. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-based exploitation with low attack complexity, requiring only low-level authenticated access (Subscriber role, which is commonly available on WordPress sites allowing user registration) and no user interaction. The technical impact is severe across all CIA triad dimensions, enabling attackers to achieve complete administrative control. The exploitation path is straightforward: attackers simply append crafted parameters to admin URLs to trigger the vulnerable code path. While EPSS and KEV status data are not provided in the intelligence, the combination of low complexity, minimal prerequisites (subscriber account), and severe impact (privilege escalation to administrator) makes this a priority for immediate remediation. The availability of specific code references in the WordPress plugin repository and detailed technical analysis from Wordfence increases the likelihood of weaponization and exploitation in the wild. |
| Exploit ScenarioDerived | An attacker registers a Subscriber-level account on a WordPress site running the vulnerable WP Extended plugin version 3.2.4 or earlier. The attacker crafts a malicious request to any WordPress admin URL, appending a specially crafted query parameter that causes the isDashboardOrProfileRequest() method to return true (for example, by including strings like 'profile.php' or 'index.php' in the parameter). When the vulnerable code processes this request, it grants the attacker manage_options capability, allowing them to access the WordPress options page, modify critical settings such as the default user role, and create a new administrator account for persistent access to the compromised site. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 22, 2026
The Ultimate WordPress Toolkit - WP Extended plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 3.2.4. Authenticated attackers with Subscriber-level access can exploit an insecure URL check to gain administrative capabilities, enabling them to modify WordPress options and create new administrator accounts. This is a critical vulnerability with a CVSS score of 8.8, requiring low attack complexity and no user interaction.
Earlier versions of this analysis (1)
The Ultimate WordPress Toolkit – WP Extended plugin for WordPress contains a privilege escalation vulnerability affecting all versions up to and including 3.2.4. Authenticated attackers with Subscriber-level access can exploit an insecure URL check to gain administrative capabilities, enabling them to modify WordPress options and create new administrator accounts. This is a critical vulnerability with a CVSS score of 8.8, requiring low attack complexity and no user interaction.
RemediationAI
Site administrators should immediately upgrade The Ultimate WordPress Toolkit – WP Extended plugin to a version newer than 3.2.4 that contains the security fix, as evidenced by the changeset available at https://plugins.trac.wordpress.org/changeset?old=3475963&old_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php&new=&new_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php. Until patching is complete, administrators should consider temporarily disabling the WP Extended plugin or restricting user registration to prevent creation of new subscriber accounts that could be leveraged for exploitation. Additionally, audit existing user accounts for unexpected privilege escalations and review recent WordPress option changes in the database for unauthorized modifications. Monitor WordPress admin access logs for suspicious URL patterns containing dashboard or profile-related strings in query parameters that may indicate exploitation attempts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability (CWE-269: Improper Privilege Management) exists in the Menu Editor module of the WP Extended plugin, specifically affecting cpe:2.3:a:wpextended:the_ultimate_wordpress_toolkit_–_wp_extended. The flaw stems from the isDashboardOrProfileRequest() method using an insecure strpos() check against the REQUEST_URI server variable to determine if a request targets the dashboard or profile page. When this check returns true, the grantVirtualCaps() method, hooked into WordPress's user_has_cap filter, inappropriately grants elevated capabilities including manage_options. The use of strpos() for security decisions is problematic because it performs simple substring matching without proper validation, allowing attackers to bypass the intended security control by manipulating the URL with crafted query parameters. This represents a fundamental authentication and authorization bypass in the plugin's capability management system.
Know when The Ultimate Wordpress Toolkit Wp Extended gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
The 'The Ultimate WordPress Toolkit - WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the isDashboardOrProfileRequest() method in the Menu Editor module using an insecure strpos() check against $_SERVER['REQUEST_URI'] to determine if a request targets the dashboard or profile page. The grantVirtualCaps() method, which is hooked into the user_has_cap filter, grants elevated capabilities including manage_options when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.
Executive ViewAI
The Ultimate WordPress Toolkit plugin contains a critical privilege escalation vulnerability that allows any logged-in user to gain full administrator access and compromise WordPress installations. This poses an immediate threat to all organizations using this plugin, as attackers can takeover sites, steal data, and deploy malware without detection.
Immediately disable the WP Extended plugin across all WordPress installations. Implement Web Application Firewall (WAF) rules to restrict admin account creation endpoints and monitor for suspicious privilege escalation attempts. Enforce IP whitelisting for WordPress admin dashboard access. Restrict user registration and limit subscriber-level account creation. Enable comprehensive logging and alerting for administrator account modifications. Consider network segmentation to isolate WordPress instances. Perform immediate forensic review of all administrator accounts created post-deployment of affected plugin versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB