CVE-2024-11916: The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing…

PriorityP428medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.20%

10.4th percentile

The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification and retrieval of data due to a missing capability check on several functions in all versions up to, and including, 3.0.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to import and activate arbitrary code snippets along with

Affected

2 ranges

Vendor	Product	Version range	Fixed in
wpextended	the_ultimate_wordpress_toolkit_wp_extended	<= 3.0.11	—
wpextended	wp_extended	< 3.0.12	3.0.12

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.