CVE-2024-11816 is a missing authorization vulnerability (CWE-862) in The Ultimate WordPress Toolkit – WP Extended plugin for WordPress, specifically in version 3.0.11. The issue arises because the 'wpext_handle_snippet_update' function lacks proper capability checks, enabling authenticated users with minimal privileges (Subscriber-level and above) to execute arbitrary code on the server. This requires that an administrator has created at least one code snippet beforehand. The vulnerability is remotely exploitable over the network without user interaction and has a high CVSS score of 8.8, reflecting its critical impact on confidentiality, integrity, and availability.

An attacker with Subscriber-level access or higher can exploit this vulnerability to execute arbitrary code on the affected server. This compromises the server's confidentiality, integrity, and availability, potentially allowing full control over the WordPress environment. The vulnerability requires that an admin has created at least one code snippet, which is a precondition for exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user roles to trusted individuals only and monitor for suspicious activity related to code snippet management. Avoid granting Subscriber-level or higher access to untrusted users. Follow updates from the plugin vendor or WordPress security advisories for official patches or temporary mitigations.