CVE-2024-11816
Published: 08 January 2025
Summary
CVE-2024-11816 is a high-severity Missing Authorization (CWE-862) vulnerability in Wpextended Ultimate Wordpress Toolkit. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 4.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
The Ultimate WordPress Toolkit – WP Extended plugin for WordPress version 3.0.11 contains a remote code execution vulnerability stemming from a missing capability check in the wpext_handle_snippet_update function. The flaw is tracked as CWE-862 and carries a CVSS 3.1 score of 8.8.
Authenticated attackers with subscriber-level access or higher can exploit the issue to execute arbitrary code on the server, provided an administrator has previously created at least one code snippet. The attack requires no user interaction and can be performed over the network.
Public references include the plugin source on WordPress Trac, a changeset that addresses the affected code, and a detailed entry from Wordfence that outlines the vulnerability and its prerequisites.
EPSS scores for the CVE stand at a current value of 0.1803 with a recorded peak of 0.1884, indicating moderate and relatively stable exploitation probability since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34339
Vulnerability details
The Ultimate WordPress Toolkit – WP Extended plugin for WordPress is vulnerable to Remote Code Execution in version 3.0.11. This is due to a missing capability check on the 'wpext_handle_snippet_update' function. This makes it possible for authenticated attackers, with Subscriber-level…
more
access and above, to execute code on the server providing an admin has created at least one code snippet.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
RCE in public-facing WordPress plugin via missing authz directly maps to T1190; arbitrary code execution enables T1059.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for logical access, directly addressing the missing capability check in wpext_handle_snippet_update that enables authenticated low-privilege users to achieve RCE.
Employs the principle of least privilege to restrict Subscriber-level and higher users from executing privileged snippet update functions leading to arbitrary code execution.
Requires timely identification, reporting, and correction of flaws like the RCE vulnerability in WP Extended plugin version 3.0.11 through patching or updates.