CVE-2024-11816

HIGH

The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpext_handle_snippet_up...

Affects 1 product across 1 vendor.

CVSS 3.18.8
EPSS0.8%
Percentile55th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-862: Missing Authorization

Software does not check whether an authenticated actor has permission for the requested operation.

Related Attack Patterns (CAPEC)
CAPEC-665 Exploitation of Thunderbolt Protection Flaws
via CWE-862

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A high severity vulnerability affects Wpextended systems (CVE-2024-11816). No public exploit code is currently available. Apply available vendor patches promptly.

BSID: BS-2025-GLOBAL-182771-H • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-11816?
A high severity vulnerability affects Wpextended systems (CVE-2024-11816). No public exploit code is currently available. Apply available vendor patches promptly.
What is the CVSS score for CVE-2024-11816?
CVE-2024-11816 has CVSS 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.8%.
Is CVE-2024-11816 actively exploited?
No confirmed active exploitation of CVE-2024-11816 as of 2026-09-25.
How do I remediate CVE-2024-11816?
Priority: MEDIUM.
What systems are affected by CVE-2024-11816?
CVE-2024-11816 affects Wpextended Ultimate Wordpress Toolkit.
Vulnerability Details
CVE IDCVE-2024-11816
BSIDBS-2025-GLOBAL-182771-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published2025-01-08
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
Missing Authorization
SourceNVD
Official Description

The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpext_handle_snippet_update' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server providing an admin has created at least one code snippet.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpext_handle_snippet_update' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server providing an admin has created at least one code snippet. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products
VendorProductAffected Versions
Wpextended Ultimate Wordpress Toolkit < 3.0.12
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 646 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashaa06ef3a2bc31ab676e4f2eb79312feb403823265372f6ba30b5d7c6c2c6b6a48713f52105cf8fffead935f94c0684d040eeeba4cd1a5e6e802f90e5522af843
Related CVEs affecting Wpextended
CVE-2024-8102 8.8 The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vuln... CVE-2025-30796 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... CVE-2024-47386 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scri... CVE-2024-8104 6.5 The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vuln... CVE-2024-8106 6.5 The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vuln...
View all Wpextended CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →