CVE-2024-8102

CVE-2024-8102 is a high-severity vulnerability affecting all versions up to and including 3.0.8 of The Ultimate WordPress Toolkit – WP Extended plugin. It allows authenticated attackers, even with Subscriber-level access, to modify arbitrary WordPress options due to a missing capability check. This can be exploited to enable user registration and set the default role to Administrator, granting attackers full administrative control over the site. The vulnerability has a CVSS score of 8.8 (High) and a FAUCET Risk Score of 69/100, indicating a significant risk with low attack complexity. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.