Описание
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the isDashboardOrProfileRequest() method in the Menu Editor module using an insecure strpos() check against $_SERVER['REQUEST_URI'] to determine if a request targets the dashboard or profile page. The grantVirtualCaps() method, which is hooked into the user_has_cap filter, grants elevated capabilities including manage_options when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the isDashboardOrProfileRequest() method in the Menu Editor module using an insecure strpos() check against $_SERVER['REQUEST_URI'] to determine if a request targets the dashboard or profile page. The grantVirtualCaps() method, which is hooked into the user_has_cap filter, grants elevated capabilities including manage_options when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2026-4314
- https://plugins.trac.wordpress.org/browser/wpextended/tags/3.2.4/modules/menu-editor/Bootstrap.php#L135
- https://plugins.trac.wordpress.org/browser/wpextended/tags/3.2.4/modules/menu-editor/Bootstrap.php#L207
- https://plugins.trac.wordpress.org/changeset?old=3475963&old_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php&new=&new_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/38ea001c-6edb-4f36-a7ec-19be1d857b9e?source=cve
Связанные уязвимости
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using an insecure `strpos()` check against `$_SERVER['REQUEST_URI']` to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` method, which is hooked into the `user_has_cap` filter, grants elevated capabilities including `manage_options` when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.