CVE-2024-8102: WP Extended Privilege Escalation Vulnerability

CVE-2024-8102 Overview

The Ultimate WordPress Toolkit – WP Extended plugin contains a missing authorization vulnerability [CWE-862] that allows authenticated attackers to escalate privileges to administrator. The flaw resides in the module_all_toggle_ajax() function, which lacks a capability check in all versions up to and including 3.0.8. Attackers with Subscriber-level access can invoke the AJAX handler to modify arbitrary WordPress options. By toggling the default registration role to administrator and enabling open user registration, an attacker gains administrative control of the affected site.

Critical Impact
Subscriber-level attackers can escalate to full administrator access on any vulnerable WordPress site running WP Extended 3.0.8 or earlier.

Affected Products

WP Extended (Ultimate WordPress Toolkit) plugin versions up to and including 3.0.8
WordPress sites with the plugin installed and open to authenticated Subscriber-level users
All WordPress deployments regardless of hosting environment when the vulnerable plugin is active

Discovery Timeline

2024-09-04 - CVE-2024-8102 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8102

Vulnerability Analysis

The vulnerability is a broken access control flaw in the WP Extended plugin's administrative AJAX interface. The module_all_toggle_ajax() function is registered as an AJAX action but does not verify that the requesting user holds an appropriate administrative capability such as manage_options. Because WordPress exposes admin-ajax.php endpoints to any authenticated user by default, a low-privileged Subscriber can invoke the handler and pass arbitrary option names and values.

An attacker leverages the write primitive to modify two core WordPress options: default_role and users_can_register. Setting default_role to administrator and enabling users_can_register allows the attacker to register a new account that is automatically granted administrator privileges. This converts a low-value Subscriber account into full site compromise.

Root Cause

The root cause is a missing capability check inside module_all_toggle_ajax() in admin/class-wp-extended-admin.php. The handler executes privileged option updates without calling current_user_can() or validating that the request originates from an administrator. The nonce alone, if present, does not enforce role restrictions.

Attack Vector

Exploitation requires network access to wp-admin/admin-ajax.php and any authenticated session at Subscriber level or above. The attacker sends a crafted POST request invoking the vulnerable AJAX action with option names and values of their choosing. No user interaction from a site administrator is required, and the attack completes in a single request chain. See the WordPress Plugin Code Reference and the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2024-8102

Indicators of Compromise

Unexpected changes to the default_role option value, particularly a switch from subscriber to administrator
The users_can_register option toggled to 1 without a corresponding administrator action
New administrator accounts created shortly after Subscriber-level logins
POST requests to /wp-admin/admin-ajax.php referencing WP Extended module toggle actions from non-admin users

Detection Strategies

Review WordPress wp_options table for changes to default_role and users_can_register
Audit web server access logs for admin-ajax.php calls invoking WP Extended actions from low-privileged accounts
Correlate user registration events with recently authenticated Subscriber sessions and source IP addresses

Monitoring Recommendations

Enable WordPress audit logging to capture option changes, role modifications, and user creation events
Alert on any elevation of a Subscriber account to administrator through the wp_capabilities user meta field
Monitor plugin version inventory to identify hosts still running WP Extended at or below version 3.0.8

How to Mitigate CVE-2024-8102

Immediate Actions Required

Update the WP Extended plugin to a version later than 3.0.8 on all affected WordPress installations
Audit existing administrator accounts and remove any that were created after the plugin was installed and cannot be attributed to a legitimate admin
Reset the default_role option to subscriber and set users_can_register to 0 unless open registration is a documented requirement
Rotate credentials and application passwords for all administrator accounts following remediation

Patch Information

The vendor released a fix in the WP Extended plugin following version 3.0.8. The corrective changeset adds capability enforcement to the affected AJAX handler. Refer to the WordPress Plugin Changeset Update for the applied source code changes.

Workarounds

Disable and remove the WP Extended plugin if an immediate patch cannot be applied
Restrict Subscriber-level registrations by disabling open registration until the plugin is updated
Deploy a web application firewall rule to block POST requests to admin-ajax.php invoking WP Extended module toggle actions from non-administrator sessions

bash

# Configuration example
# Disable open registration and reset default role via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber

# Verify the currently installed WP Extended version
wp plugin get wpextended --field=version

# Update the plugin to the patched release
wp plugin update wpextended