---
id: "CVE-2026-123481"
page: "https://infrastack.ai/live/CVE-2026-123481"
kind: "vulnerability"
aliases: ["CVE-2026-123481"]
title: "WP Extended WordPress Toolkit: missing authorization check on access control"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "The Ultimate WordPress Toolkit \u2013 WP Extended", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["package", "self-hosted", "wordpress", "wp-extended"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-11T13:17:17+00:00"
first_seen_at: "2026-11-11T13:27:12+00:00"
updated_at: "2026-11-11T13:29:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123481", "first_seen_at": "2026-11-11T13:27:12+00:00"}]
exploit_sources: []
---

# WP Extended WordPress Toolkit: missing authorization check on access control

Link for people: https://infrastack.ai/live/CVE-2026-123481 (this .md is for agents)

The Ultimate WordPress Toolkit (WP Extended) has a missing authorization check, so access controls are not enforced as intended. Per the NVD entry, affected versions run through 3.4.2, and an attacker may be able to reach functions they should not.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:The Ultimate WordPress Toolkit – WP Extended affected range not listed fixed no fixed version listed

## How to check

- Check the installed version of The Ultimate WordPress Toolkit (WP Extended) in the WordPress plugin list or the plugin's main file header; versions through `3.4.2` are listed as affected.
- Confirm whether the plugin is active on the site.

## Timeline

- 2026-11-11T13:27:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123481

## From the sources

Missing Authorization vulnerability in WP Extended The Ultimate WordPress Toolkit – WP Extended wpextended allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Ultimate WordPress Toolkit – WP Extended: from n/a through 3.4.2.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_