CVE-2026-4314 is a privilege escalation vulnerability in The Ultimate WordPress Toolkit – WP Extended plugin for WordPress, affecting all versions up to 3.2.4. The vulnerability stems from the isDashboardOrProfileRequest() method in the Menu Editor module, which uses an insecure strpos() check against $_SERVER['REQUEST_URI'] to determine if a request targets the dashboard or profile page. When this check returns true, the grantVirtualCaps() method hooked into the user_has_cap filter grants elevated capabilities including manage_options. This allows authenticated users with Subscriber-level access or above to escalate privileges by appending crafted query parameters to admin URLs, thereby gaining administrative capabilities such as updating arbitrary WordPress options and creating new Administrator accounts.

An authenticated attacker with Subscriber-level access or higher can exploit this vulnerability to escalate their privileges to Administrator level. This enables them to modify critical WordPress options and create new Administrator accounts, potentially leading to full site compromise. The CVSS 3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to trusted users only and monitor for suspicious activity related to privilege escalation attempts. Avoid using affected versions of the plugin and consider disabling it if possible.