Unauthorized Data Manipulation in WP Extended Plugin for WordPress

CVE-2024-11916

What is CVE-2024-11916?

The WP Extended plugin for WordPress is susceptible to unauthorized modification and retrieval of sensitive data due to inadequate capability checks in its functions. This vulnerability can be exploited by authenticated users with subscriber-level or higher privileges, allowing them to import and execute arbitrary code snippets. As a result, attackers may gain access to restricted functionalities, threatening the integrity and security of the WordPress installation.

References