CVE-2026-123481

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123481", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-11-06T00:25:34.013Z", "datePublished": "2026-11-11T12:40:46.952Z", "dateUpdated": "2026-11-11T15:07:40.974Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-11-11T12:41:46.288Z"}, "title": "WordPress The Ultimate WordPress Toolkit \u2013 WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability", "datePublic": "2026-11-11T12:40:00.000Z", "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit \u2013 WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit \u2013 WP Extended: from n/a through 3.4.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit \u2013 WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects The Ultimate WordPress Toolkit \u2013 WP Extended: from n/a through 3.4.2.</p>"}]}], "affected": [{"vendor": "WP Extended", "product": "The Ultimate WordPress Toolkit \u2013 WP Extended", "packageName": "wpextended", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "versions": [{"version": "0", "versionType": "custom", "status": "affected", "lessThanOrEqual": "3.4.2", "changes": [{"at": "3.4.3", "status": "unaffected"}]}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/wpextended/vulnerability/wordpress-the-ultimate-wordpress-toolkit-wp-extended-plugin-3-4-2-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "credits": [{"lang": "en", "value": "Mnzn | Patchstack Bug Bounty Program", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "solutions": [{"lang": "en", "value": "Update the WordPress The Ultimate WordPress Toolkit \u2013 WP Extended plugin to the latest available version (at least 3.4.3).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress The Ultimate WordPress Toolkit \u2013 WP Extended plugin to the latest available version (at least 3.4.3)."}]}], "tags": ["x_open-source"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-11T15:02:43.419292Z", "id": "CVE-2026-123481", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-11T15:07:40.974Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123481", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-11-06T00:25:34.013Z", "datePublished": "2026-11-11T12:40:46.952Z", "dateUpdated": "2026-11-11T15:07:40.974Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-11-11T12:41:46.288Z"}, "title": "WordPress The Ultimate WordPress Toolkit \u2013 WP Extended plugin <= 3.4.2 - Broken Access Control vulnerability", "datePublic": "2026-11-11T12:40:00.000Z", "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit \u2013 WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit \u2013 WP Extended: from n/a through 3.4.2.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit \u2013 WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects The Ultimate WordPress Toolkit \u2013 WP Extended: from n/a through 3.4.2.</p>"}]}], "affected": [{"vendor": "WP Extended", "product": "The Ultimate WordPress Toolkit \u2013 WP Extended", "packageName": "wpextended", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "versions": [{"version": "0", "versionType": "custom", "status": "affected", "lessThanOrEqual": "3.4.2", "changes": [{"at": "3.4.3", "status": "unaffected"}]}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/wpextended/vulnerability/wordpress-the-ultimate-wordpress-toolkit-wp-extended-plugin-3-4-2-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "credits": [{"lang": "en", "value": "Mnzn | Patchstack Bug Bounty Program", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "solutions": [{"lang": "en", "value": "Update the WordPress The Ultimate WordPress Toolkit \u2013 WP Extended plugin to the latest available version (at least 3.4.3).", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Update the WordPress The Ultimate WordPress Toolkit \u2013 WP Extended plugin to the latest available version (at least 3.4.3)."}]}], "tags": ["x_open-source"]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-123481", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-11T15:02:43.419292Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-11T15:07:32.867Z"}}]}}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "wpextended", "product": "The Ultimate WordPress Toolkit \u2013 WP Extended", "vendor": "WP Extended", "versions": [{"changes": [{"at": "3.4.3", "status": "unaffected"}], "lessThanOrEqual": "3.4.2", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit \u2013 WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit \u2013 WP Extended: from n/a through 3.4.2."}], "id": "CVE-2026-123481", "lastModified": "2026-11-11T15:17:18.210", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-123481", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-11T15:02:43.419292Z", "version": "2.0.3"}}]}, "published": "2026-11-11T13:17:17.683", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/wpextended/vulnerability/wordpress-the-ultimate-wordpress-toolkit-wp-extended-plugin-3-4-2-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"created": "2026-11-11T23:00:09.381731+00:00", "updated": "2026-11-13T11:30:08.021245+00:00", "vendors": []}