{"id":"CVE-2026-123481","kind":"vulnerability","aliases":["CVE-2026-123481"],"related":[],"title":"WP Extended WordPress Toolkit: missing authorization check on access control","description":"Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2.","summary":"The Ultimate WordPress Toolkit (WP Extended) has a missing authorization check, so access controls are not enforced as intended. Per the NVD entry, affected versions run through 3.4.2, and an attacker may be able to reach functions they should not.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"The Ultimate WordPress Toolkit – WP Extended","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["package","self-hosted","wordpress","wp-extended"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of The Ultimate WordPress Toolkit (WP Extended) in the WordPress plugin list or the plugin's main file header; versions through `3.4.2` are listed as affected.\n- Confirm whether the plugin is active on the site.","fix":null,"status":"open","published_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","triaged_at":"2026-11-11T13:29:55+00:00","updated_at":"2026-11-11T13:29:55+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T13:29:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"WP Extended WordPress Toolkit: missing authorization check on access control","impact":"medium","summary":"The Ultimate WordPress Toolkit (WP Extended) has a missing authorization check, so access controls are not enforced as intended. Per the NVD entry, affected versions run through 3.4.2, and an attacker may be able to reach functions they should not.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-extended","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may reach restricted plugin functions","analyst_note":"Find the vulnerable function and whether a fixed version exists via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-123481 and the WordPress plugin page.","how_to_check":"- Check the installed version of The Ultimate WordPress Toolkit (WP Extended) in the WordPress plugin list or the plugin's main file header; versions through `3.4.2` are listed as affected.\n- Confirm whether the plugin is active on the site.","plain_action":"","product_name":"The Ultimate WordPress Toolkit – WP Extended","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running The Ultimate WordPress Toolkit (WP Extended) at version 3.4.2 or earlier are listed as affected. The sources do not say which functions lack the check or whether a logged-in account is needed, so the exposure is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000764,"input_tokens":4570,"output_tokens":615,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123481':13A,16A '-2026':12A,15A '3.4.2':58B,100C 'abl':64B 'access':9A,43B,85C 'affect':54B,90C 'allow':81C 'attack':61B 'author':6A,40B,69C 'check':7A,41B 'configur':84C 'control':10A,44B,86C 'cve':11A,14A 'enforc':47B 'entri':53B 'exploit':82C 'extend':2A,30B,36B,73C,79C,96C 'extended':22A 'function':67B 'host':26B 'incorrect':83C 'intend':49B 'issu':89C 'levels.this':88C 'may':62B 'miss':5A,39B,68C 'n/a':98C 'nvd':52B 'packag':23B 'per':50B 'reach':66B 'run':56B 'secur':87C 'self':25B 'self-host':24B 'the':17A 'toolkit':4A,20A,34B,77C,94C 'ultim':32B,75C,92C 'ultimate':18A 'version':55B 'vulner':70C 'wordpress':3A,19A,27B,33B,76C,93C 'wp':1A,21A,29B,35B,72C,78C,95C 'wp-extend':28B 'wpextend':80C","nicknames":[],"mitigations":[],"who_affected":"Sites running The Ultimate WordPress Toolkit (WP Extended) at version 3.4.2 or earlier are listed as affected. The sources do not say which functions lack the check or whether a logged-in account is needed, so the exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["theultimatewordpresstoolkitwpextended","ultimatewordpresstoolkitwpextended"],"ptokens":["extended","the","toolkit","ultimate","wordpress","wp"],"labels":["medium","package","selfhosted","vendor","wordpress","wpextended"],"campaign_type":null,"search_a":"'-123481':13A,16A '-2026':12A,15A 'access':9A 'author':6A 'check':7A 'control':10A 'cve':11A,14A 'extend':2A 'extended':22A 'miss':5A 'the':17A 'toolkit':4A,20A 'ultimate':18A 'wordpress':3A,19A 'wp':1A,21A","search_b":"'3.4.2':58B 'abl':64B 'access':43B 'affect':54B 'attack':61B 'author':40B 'check':41B 'control':44B 'enforc':47B 'entri':53B 'extend':30B,36B 'function':67B 'host':26B 'intend':49B 'may':62B 'miss':39B 'nvd':52B 'packag':23B 'per':50B 'reach':66B 'run':56B 'self':25B 'self-host':24B 'toolkit':34B 'ultim':32B 'version':55B 'wordpress':27B,33B 'wp':29B,35B 'wp-extend':28B","search_c":"'3.4.2':100C 'access':85C 'affect':90C 'allow':81C 'author':69C 'configur':84C 'control':86C 'exploit':82C 'extend':73C,79C,96C 'incorrect':83C 'issu':89C 'levels.this':88C 'miss':68C 'n/a':98C 'secur':87C 'toolkit':77C,94C 'ultim':75C,92C 'vulner':70C 'wordpress':76C,93C 'wp':72C,78C,95C 'wpextend':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T13:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123481","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123481","severity":null,"published_at":"2026-11-11T13:17:17+00:00","modified_at":"2026-11-11T13:17:17+00:00","first_seen_at":"2026-11-11T13:27:12+00:00","fetched_at":"2026-11-11T13:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}