CVE-2026-4314 Privilege escalation in The Ultimate WordPress Toolkit – WP Extended
Authenticated subscribers can escalate to administrator privileges by exploiting insecure request URI checks in the Menu Editor module.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-4314?
CVE-2026-4314 is a high-severity vulnerability in wpextended The Ultimate WordPress Toolkit – WP Extended, published on 22 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The 'The Ultimate WordPress Toolkit – WP Extended' plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.2.4. This is due to the `isDashboardOrProfileRequest()` method in the Menu Editor module using an insecure `strpos()` check against `$_SERVER['REQUEST_URI']` to determine if a request targets the dashboard or profile page. The `grantVirtualCaps()` method, which is hooked into the `user_has_cap` filter, grants elevated capabilities including `manage_options` when this check returns true. This makes it possible for authenticated attackers, with Subscriber-level access and above, to gain administrative capabilities by appending a crafted query parameter to any admin URL, allowing them to update arbitrary WordPress options and ultimately create new Administrator accounts.
Weakness: CWE-269
Which versions are affected by CVE-2026-4314?
How do I fix CVE-2026-4314?
No fix has been published for CVE-2026-4314 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-4314 being exploited?
There is no known exploitation of CVE-2026-4314 in the wild and no public exploit code.
Sources
Also known as GHSA-r5jq-wvhc-w6jv.