Unauthorized Modification of User Names in WP Extended Plugin Due to Lack of Capability Check

CVE-2024-8121

Summary

The Ultimate WordPress Toolkit – WP Extended plugin for WordPress has a vulnerability that allows for unauthorized modification of usernames due to a missing capability check on the wpext_change_admin_name() function. Any authenticated users with Subscriber-level access or higher can exploit this flaw to change an admin's username to any preferred name, particularly targeting those using the default 'admin' username. This poses a significant security risk as it can facilitate impersonation and unauthorized access to admin functionalities.

References