CVE-2024-8102 is a missing authorization vulnerability (CWE-862) in The Ultimate WordPress Toolkit – WP Extended plugin for WordPress, affecting all versions up to 3.0.8. The vulnerability exists due to the absence of a capability check in the module_all_toggle_ajax() function, enabling authenticated users with low privileges (Subscriber-level and above) to update arbitrary WordPress options. This can be exploited to escalate privileges by setting the default registration role to administrator and enabling user registration, thereby allowing attackers to create administrative accounts on the affected WordPress site. The CVSS v3.1 base score is 8.8, indicating a high severity impact on confidentiality, integrity, and availability.

An attacker with Subscriber-level access or higher can exploit this vulnerability to escalate privileges to administrator by modifying site options, including changing the default user role for new registrations and enabling user registration. This leads to a complete compromise of the WordPress site, affecting confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access and monitor for unauthorized changes to site options. Avoid enabling user registration or changing default roles unless necessary and ensure strict access controls on plugin usage.