Description
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using an insecure `strpos()` check against `$_SERVER['REQUEST_URI']` to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` method, which is hooked into the `user_has_cap` filter, grants elevated capabilities including `manage_options` when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.
INFO
Published Date :
2026-03-22T03:26:34.034Z
Last Modified :
2026-04-08T16:46:38.168Z
Source :
Wordfence
AFFECTED PRODUCTS
The following products are affected by CVE-2026-4314 vulnerability.
| Vendors | Products |
|---|---|
| Wordpress |
|
| Wpextended |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2026-4314.
