CVE-2024-8121

Name of the Vulnerable Software and Affected Versions: The Ultimate WordPress Toolkit – WP Extended plugin for WordPress version 3.0.8 and earlier

Description: The issue allows authenticated attackers with Subscriber-level access and above to change an admin's username to a username of their liking, as long as the default 'admin' was used, due to a missing capability check on the wpext change admin name() function.

Recommendations: For versions up to and including 3.0.8, update the plugin to the latest patched version immediately to resolve the issue. As a temporary workaround, consider restricting access to the wpext change admin name() function until a patch is available.