Unauthorized Modification of User Names in WP Extended Plugin Due to Lack of Capability Check

CVE-2024-8121

What is CVE-2024-8121?

The Ultimate WordPress Toolkit – WP Extended plugin for WordPress has a vulnerability that allows for unauthorized modification of usernames due to a missing capability check on the wpext_change_admin_name() function. Any authenticated users with Subscriber-level access or higher can exploit this flaw to change an admin's username to any preferred name, particularly targeting those using the default 'admin' username. This poses a significant security risk as it can facilitate impersonation and unauthorized access to admin functionalities.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References