Privilege Escalation in Nexter Extension WordPress Plugin

The Nexter Extension - Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.7.11 (CVE-2026-111114). The vulnerability resides in the role switcher functionality, specifically within the role_switcher_to_view_admin_as() function, which lacks appropriate nonce and capability checks.

The flaw is compounded by an inadequate cleanup mechanism in the profile_update hook. When a user is demoted from Administrator using the bulk role-change control in wp-admin/users.php, the plugin fails to clear the nxtext_view_admin_original_role user meta. Because this bypasses the standard profile_update hook, the stale administrator role persists in the user profile. Authenticated users who were previously administrators and demoted via this specific bulk path can trigger the /?reset-view handler to restore their administrator privileges, granting them unauthorized full access to the WordPress environment.

Impact

Successful exploitation allows a user with Subscriber-level access or higher to escalate their privileges to Administrator. This impact is contingent on the attacker having previously held Administrator status and having been demoted specifically via the WordPress bulk user management interface. This vulnerability affects any WordPress site utilizing the Nexter Extension plugin (<= 4.7.11).

Recommendation

• Update the Nexter Extension plugin to a version addressing CVE-2026-111114 immediately.
• Audit the wp_usermeta table for suspicious entries in the nxtext_view_admin_original_role column, particularly for users who should not currently possess administrative privileges.
• Restrict administrative access to the WordPress bulk user management interface to trusted personnel until the plugin is patched.