CVE-2026-4314 PUBLISHED

The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module

Assigner: Wordfence
Reserved: 17.03.2026 Published: 22.03.2026 Updated: 22.03.2026

The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the isDashboardOrProfileRequest() method in the Menu Editor module using an insecure strpos() check against $_SERVER['REQUEST_URI'] to determine if a request targets the dashboard or profile page. The grantVirtualCaps() method, which is hooked into the user_has_cap filter, grants elevated capabilities including manage_options when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 8.8

Product Status

Vendor wpextended
Product The Ultimate WordPress Toolkit – WP Extended
Versions Default: unaffected
  • affected from * to 3.2.4 (incl.)

Credits

  • Hung Nguyen finder

References

Problem Types

  • CWE-269 Improper Privilege Management CWE