CVE-2024-11816

Summary

CVE-2024-11816 is a Remote Code Execution vulnerability affecting version 3.0.11 of the Ultimate WordPress Toolkit – WP Extended plugin. This issue arises due to a missing capability check in the 'wpext_handle_snippet_update' function. Authenticated attackers, with a Subscriber-level access or higher, can exploit this vulnerability and execute code on the server, provided an admin has created at least one code snippet. Successful exploitation could lead to significant security risks, including unauthorized access, data theft, or server compromise. Users are strongly urged to update the plugin to a patched version as soon as possible to mitigate this vulnerability.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.