133 lines
5.7 KiB
JSON
133 lines
5.7 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2026-4314",
|
||
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Wordfence",
|
||
"dateReserved": "2026-03-17T07:35:15.205Z",
|
||
"datePublished": "2026-03-22T03:26:34.034Z",
|
||
"dateUpdated": "2026-04-08T16:46:38.168Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
|
||
"shortName": "Wordfence",
|
||
"dateUpdated": "2026-04-08T16:46:38.168Z"
|
||
},
|
||
"affected": [
|
||
{
|
||
"vendor": "wpextended",
|
||
"product": "The Ultimate WordPress Toolkit – WP Extended",
|
||
"versions": [
|
||
{
|
||
"version": "0",
|
||
"status": "affected",
|
||
"lessThanOrEqual": "3.2.4",
|
||
"versionType": "semver"
|
||
}
|
||
],
|
||
"defaultStatus": "unaffected"
|
||
}
|
||
],
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using an insecure `strpos()` check against `$_SERVER['REQUEST_URI']` to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` method, which is hooked into the `user_has_cap` filter, grants elevated capabilities including `manage_options` when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts."
|
||
}
|
||
],
|
||
"title": "The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module",
|
||
"references": [
|
||
{
|
||
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/38ea001c-6edb-4f36-a7ec-19be1d857b9e?source=cve"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/wpextended/tags/3.2.4/modules/menu-editor/Bootstrap.php#L135"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/browser/wpextended/tags/3.2.4/modules/menu-editor/Bootstrap.php#L207"
|
||
},
|
||
{
|
||
"url": "https://plugins.trac.wordpress.org/changeset?old=3475963&old_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php&new=&new_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php"
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"description": "CWE-269 Improper Privilege Management",
|
||
"cweId": "CWE-269",
|
||
"type": "CWE"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 8.8,
|
||
"baseSeverity": "HIGH"
|
||
}
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"type": "finder",
|
||
"value": "Hung Nguyen"
|
||
}
|
||
],
|
||
"timeline": [
|
||
{
|
||
"time": "2026-03-18T13:46:44.000Z",
|
||
"lang": "en",
|
||
"value": "Vendor Notified"
|
||
},
|
||
{
|
||
"time": "2026-03-21T14:34:53.000Z",
|
||
"lang": "en",
|
||
"value": "Disclosed"
|
||
}
|
||
]
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"timestamp": "2026-03-23T16:25:12.331849Z",
|
||
"id": "CVE-2026-4314",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "total"
|
||
}
|
||
],
|
||
"role": "CISA Coordinator",
|
||
"version": "2.0.3"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2026-03-23T16:25:36.016Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |