What the vulnerability does
01Description
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using an insecure `strpos()` check against `$_SERVER['REQUEST_URI']` to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` method, which is hooked into the `user_has_cap` filter, grants elevated capabilities including `manage_options` when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.
Explanation of Vulnerability in Simple Terms
02Summary
WP Extended versions up to 3.2.4 contain a privilege management flaw that allows authenticated users with low-level permissions to gain unauthorized access to sensitive functions and data. An attacker with a basic user account can read, modify, or delete site content and settings without proper authorization checks. This affects all installations running the vulnerable version range.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete site data and settings using a low-privilege user account.
Potential impact on your site
04Site Impact
Any user with basic site access can escalate their capabilities to perform admin-level actions without authorization.
Conditions required to exploit
05Prerequisites
Attacker must have a valid low-privilege WordPress user account (e.g., Subscriber or Contributor role).
Key dates
06Disclosure timeline
March 22, 2026
CVE published
April 8, 2026
Record updated
