CVE-2024-8102
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on t...
Affects 1 product across 1 vendor.
Software does not check whether an authenticated actor has permission for the requested operation.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data, which can lead to privilege escalation due to a missing capability check.
BSID: BS-2024-GLOBAL-226065-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2024-8102?
What is the CVSS score for CVE-2024-8102?
Is CVE-2024-8102 actively exploited?
How do I remediate CVE-2024-8102?
What systems are affected by CVE-2024-8102?
| CVE ID | CVE-2024-8102 |
|---|---|
| BSID | BS-2024-GLOBAL-226065-H BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| Published | 2024-09-04 |
| Last Modified | 2024-09-05 |
| ICS Relevance | 15% |
| Weakness (CWE) | |
| Source | NVD |
The The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the module_all_toggle_ajax() function in all versions up to, and including, 3.0.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
Source: NIST NVD / MITRE CVE Database
Authenticated attackers with Subscriber-level access and above can exploit the vulnerability in the module_all_toggle_ajax() function to update arbitrary options, potentially escalating their privileges.
Exploitation Likelihood: HIGH
| Vendor | Product | Affected Versions |
|---|---|---|
| Wpextended | Wp Extended | < 3.0.9 |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | /workspace/models/qwen2.5-coder-32b-instruct-bf16 |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 66973856467e3f524df206af33c60348ff23a127edd94baa0428e7032d9f4f8e5c7ec20ea3554343e81ab48191793c7099067fce15990eed582b87aaaaa83b4c |
ICS/OT Vulnerability Intelligence for Your Environment
BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.
Create a free account →