Unauthorized Data Modification Vulnerability in WP Extended Plugin

CVE-2024-8102

Summary

The WP Extended plugin for WordPress, developed by Ultimate WordPress Toolkit, is susceptible to unauthorized data modification due to an oversight in the module_all_toggle_ajax() function. This vulnerability affects all versions up to and including 3.0.8, allowing authenticated users with Subscriber-level access and above to alter WordPress site options without necessary permissions. Exploiting this vulnerability enables attackers to change the default role for new user registrations to administrator and to activate user registration features, thereby granting them administrative access to compromised sites.

References