CVE-2024-8121

CVE-2024-8121 affects The Ultimate WordPress Toolkit – WP Extended plugin, versions up to and including 3.0.8, allowing authenticated users to change an administrator's username if it's the default 'admin'. This vulnerability has a CVSS score of 4.3 (Medium) due to a missing capability check, enabling low-privileged attackers (Subscriber-level and above) to modify usernames without requiring user interaction. While the impact is limited to unauthorized username modification, there is no evidence of active exploitation, publicly available exploit code, or significant community discussion surrounding this CVE.