Description
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using an insecure `strpos()` check against `$_SERVER['REQUEST_URI']` to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` method, which is hooked into the `user_has_cap` filter, grants elevated capabilities including `manage_options` when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
wpextended The Ultimate WordPress Toolkit – WP Extended
Default version status: unaffected
0 to ≤ 3.2.4affected
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/38ea001c-6edb-4f36-a7ec-19be1d857b9e?source=cve ↗
- https://plugins.trac.wordpress.org/browser/wpextended/tags/3.2.4/modules/menu-editor/Bootstrap.php#L135 ↗
- https://plugins.trac.wordpress.org/browser/wpextended/tags/3.2.4/modules/menu-editor/Bootstrap.php#L207 ↗
- https://plugins.trac.wordpress.org/changeset?old=3475963&old_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php&new=&new_path=wpextended%2Ftrunk%2Fmodules%2Fmenu-editor%2FBootstrap.php ↗