CVE-2024-11916 is a missing authorization vulnerability (CWE-862) in The Ultimate WordPress Toolkit – WP Extended plugin for WordPress, affecting all versions up to and including 3.0.11. The vulnerability arises because several functions lack proper capability checks, enabling authenticated users with subscriber-level privileges or above to import and activate arbitrary code snippets. This can lead to unauthorized modification and retrieval of data, impacting the confidentiality, integrity, and availability of the WordPress environment. The CVSS 3.1 base score is 7.4, reflecting network attack vector, low attack complexity, privileges required, no user interaction, and a scope change with partial impact on confidentiality, integrity, and availability.

An attacker with subscriber-level access or higher can exploit this vulnerability to import and activate arbitrary code snippets, leading to unauthorized data modification and retrieval. This compromises the confidentiality, integrity, and availability of the affected WordPress site. The vulnerability could allow privilege escalation or execution of malicious code within the context of the WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict subscriber-level access to trusted users only and monitor for suspicious activity related to code snippet imports and activations. Avoid installing or updating to versions of the plugin that are not confirmed safe.