CVE-2024-8121 is a CWE-862 Missing Authorization vulnerability in The Ultimate WordPress Toolkit – WP Extended plugin for WordPress. The issue arises from the lack of a capability check in the wpext_change_admin_name() function, permitting authenticated users with low privileges (Subscriber and above) to change an administrator's username if it is set to the default 'admin'. This vulnerability affects all versions up to and including 3.0.8. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with Subscriber-level access or higher can modify the username of an administrator account if the default 'admin' username is in use. This unauthorized modification can lead to potential disruption of administrative access and denial of service conditions. There is no direct confidentiality impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider changing the default 'admin' username to a unique name to mitigate the risk. Monitoring for suspicious account modifications is advised. Avoid granting Subscriber or higher privileges to untrusted users.