What the vulnerability does
01Description
The WordPress User Extra Fields plugin for WordPress is vulnerable to privilege escalation due to a missing capability check on the ajax_save_fields() function in all versions up to, and including, 16.6. This makes it possible for authenticated attackers, with subscriber-level access and above, to add custom fields that can be updated and then use the check_and_overwrite_wp_or_woocommerce_fields function to update the wp_capabilities field to have administrator privileges.
Explanation of Vulnerability in Simple Terms
02Summary
The WordPress User Extra Fields plugin through version 16.6 fails to properly check user permissions before allowing access to sensitive user data and functions. A logged-in user with low privileges can read, modify, or delete other users' custom field data without authorization. This affects all user roles and can expose private information or allow unauthorized account modifications.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete other users' custom field data without permission.
Potential impact on your site
04Site Impact
Private user data exposed; unauthorized changes to user profiles; potential account compromise or data loss.
Conditions required to exploit
05Prerequisites
Attacker must be logged in to WordPress with a low-privilege account (e.g., subscriber or contributor).
Key dates
06Disclosure timeline
November 13, 2024
CVE published
April 8, 2026
Record updated
