Nexter Extension – Site Enhancements Toolkit <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation via View Admin As Role Switcher
- ID
- WPSEC-2026-0944
- Plugin
- Nexter Extension – Security, Performance, Code Snippets & Site Toolkit (nexter-extension)
- Affected
- from 4.3.0 before 4.7.12
- Remediation
- Update to 4.7.12 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-14
- Attack surface
- Nexter Extension – Site Enhancements Toolkit on WPSec AttackSurface
- Fix released
- Published
Description
The Nexter Extension plugin for WordPress is vulnerable to Privilege Escalation via the View Admin As role switcher in versions 4.3.0 to 4.7.11. This is due to the stored original-role user meta (nxtext_view_admin_original_role) only being cleared on the profile_update hook. A role change made directly through WP_User::set_role(), such as the Users list bulk role change, does not fire that hook and leaves the meta in place. This makes it possible for an administrator who was demoted to a different role, such as subscriber, while temporarily viewing the site as a lower role to use the switcher's 'Switch back to Administrator' or reset-view link to get the Administrator role back. Exploitation requires that the account used the role switcher and was demoted while switched.
References
- https://wpsec.com/vuln/WPSEC-2026-0944/
- https://plugins.svn.wordpress.org/nexter-extension/tags/4.7.12/
- https://wordpress.org/plugins/nexter-extension/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS