Privilege Escalation Vulnerability in Nexter Extension for WordPress

CVE-2026-111114

What is CVE-2026-111114?

The Nexter Extension for WordPress is susceptible to Privilege Escalation due to improper nonce and capability checks in the role_switcher_to_view_admin_as() function. This issue enables authenticated users with Subscriber-level access or higher to exploit the vulnerability by restoring a previously held Administrator role during bulk role changes. As the attack relies on a specific series of actions—where the attacker's account previously maintained Administrator privileges—it poses a significant risk, especially when the role-switching feature is mismanaged. The insufficient cleanup mechanism allows stale role values to remain persistent, creating opportunities for privilege escalation.

References