CVE-2024-8102: 
WordPress vulnerability analysis and mitigation

The Ultimate WordPress Toolkit – WP Extended plugin for WordPress contains a vulnerability (CVE-2024-8102) that was discovered and disclosed on September 4, 2024. This vulnerability affects all versions up to and including 3.0.8 of the plugin. The issue stems from a missing capability check in the modulealltoggle_ajax() function, which can lead to unauthorized modification of data and privilege escalation (NVD).

The vulnerability is characterized by a missing authorization check (CWE-862) in the modulealltoggle_ajax() function. It has received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, and requiring low privileges (NVD, Wordfence).

The vulnerability allows authenticated attackers with Subscriber-level access or higher to update arbitrary options on the WordPress site. This can be exploited to modify the default role for new user registrations to administrator and enable user registration, ultimately allowing attackers to gain administrative access to the vulnerable site (NVD).

Users should update to version 3.0.9 or later of the WP Extended plugin, which contains the security fix for this vulnerability (NVD).