The Ultimate WordPress Toolkit – WP Extended plugin contains a flaw in the Menu Editor module that allows authenticated users with at least Subscriber level access to gain administrative privileges. The vulnerability stems from an insecure strpos check on the request URI, which, when bypassed by appending a crafted query parameter to any admin URL, triggers a filter that grants elevated capabilities such as manage_options. Once these capabilities are granted, the attacker can modify WordPress options and create new Administrator accounts, compromising the integrity and control of the site.

All installations of The Ultimate WordPress Toolkit – WP Extended version 3.2.4 or earlier are affected. The issue resides only within this plugin and affects WordPress sites that utilize it.

With a CVSS score of 8.8, the vulnerability is considered high severity. Exploitation requires the attacker to be authenticated and possess Subscriber-level access, after which a crafted query string can be appended to an admin URL. Although EPSS data is unavailable and the vulnerability is not listed in CISA's KEV catalog, the ability to elevate privileges to full administrative control justifies urgent remediation.