{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aposimythnexter_extensionwordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:posimyth:nexter_extension:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-111114"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Nexter Extension – Security, Performance, Code Snippets \u0026 Site Toolkit (\u003c= 4.7.11)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Posimyth"],"content_html":"\u003cp\u003eThe Nexter Extension - Security, Performance, Code Snippets \u0026amp; Site Toolkit plugin for WordPress is vulnerable to privilege escalation in all versions up to and including 4.7.11 (CVE-2026-111114). The vulnerability resides in the role switcher functionality, specifically within the \u003ccode\u003erole_switcher_to_view_admin_as()\u003c/code\u003e function, which lacks appropriate nonce and capability checks.\u003c/p\u003e\n\u003cp\u003eThe flaw is compounded by an inadequate cleanup mechanism in the \u003ccode\u003eprofile_update\u003c/code\u003e hook. When a user is demoted from Administrator using the bulk role-change control in \u003ccode\u003ewp-admin/users.php\u003c/code\u003e, the plugin fails to clear the \u003ccode\u003enxtext_view_admin_original_role\u003c/code\u003e user meta. Because this bypasses the standard \u003ccode\u003eprofile_update\u003c/code\u003e hook, the stale administrator role persists in the user profile. Authenticated users who were previously administrators and demoted via this specific bulk path can trigger the \u003ccode\u003e/?reset-view\u003c/code\u003e handler to restore their administrator privileges, granting them unauthorized full access to the WordPress environment.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a user with Subscriber-level access or higher to escalate their privileges to Administrator. This impact is contingent on the attacker having previously held Administrator status and having been demoted specifically via the WordPress bulk user management interface. This vulnerability affects any WordPress site utilizing the Nexter Extension plugin (\u0026lt;= 4.7.11).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Nexter Extension plugin to a version addressing CVE-2026-111114 immediately.\u003c/li\u003e\n\u003cli\u003eAudit the \u003ccode\u003ewp_usermeta\u003c/code\u003e table for suspicious entries in the \u003ccode\u003enxtext_view_admin_original_role\u003c/code\u003e column, particularly for users who should not currently possess administrative privileges.\u003c/li\u003e\n\u003cli\u003eRestrict administrative access to the WordPress bulk user management interface to trusted personnel until the plugin is patched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:26:03Z","date_published":"2026-10-16T06:26:03Z","id":"https://feed.craftedsignal.io/briefs/2026-10-nexter-extension-privesc/","summary":"The Nexter Extension plugin for WordPress is vulnerable to privilege escalation (CVE-2026-111114) allowing authenticated users to restore elevated roles due to improper state cleanup during bulk demotions.","title":"Privilege Escalation in Nexter Extension WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-nexter-extension-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:posimyth:nexter_extension:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}