CVE-2026-123481: WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
The Ultimate WordPress Toolkit – WP Extendedto a version that resolves this vulnerability.Fixed in 3.4.3
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects The Ultimate WordPress Toolkit – WP Extended plugin versions through 3.4.2. The available data does not identify a fixed version.
What level of access does an attacker need?
An attacker needs low-privileged access to the affected WordPress site. Exploitation is network-accessible and does not require user interaction.
What is the likely impact if exploited?
The reported impact is limited confidentiality exposure. The provided severity vector indicates no integrity or availability impact.