PT-2026-26965 · Wpextended · The Ultimate Wordpress Toolkit – Wp Extended

Hung Nguyen · Published 2026-03-22 · Updated 2026-03-22 · CVE-2026-4314

NVD

CVSS v3.1

8.8

High

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the isDashboardOrProfileRequest() method in the Menu Editor module using an insecure strpos() check against $ SERVER['REQUEST URI'] to determine if a request targets the dashboard or profile page. The grantVirtualCaps() method, which is hooked into the user has cap filter, grants elevated capabilities including manage options when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-4314

Affected Products

The Ultimate Wordpress Toolkit – Wp Extended

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-4314 · Security Note
• https://plugins.trac.wordpress.org/browser/wpextended/tags/3.2.4/modules/menu-editor/Bootstrap.php#L135 · Note
• https://plugins.trac.wordpress.org/browser/wpextended/tags/3.2.4/modules/menu-editor/Bootstrap.php#L207 · Note
• https://plugins.trac.wordpress.org/changeset?old=3475963&old_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php&new=&new_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/38ea001c-6edb-4f36-a7ec-19be1d857b9e?source=cve · Note