# Nexter Extension – Site Enhancements Toolkit <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation via View Admin As Role Switcher

- **ID:** WPSEC-2026-0944
- **Plugin:** Nexter Extension – Security, Performance, Code Snippets & Site Toolkit (`nexter-extension`), https://wordpress.org/plugins/nexter-extension/
- **Affected versions:** from 4.3.0 before 4.7.12
- **Fixed in:** 4.7.12 (Update to 4.7.12 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/nexter-extension
- **Fix released:** 2026-10-12
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0944/

## Description

The Nexter Extension plugin for WordPress is vulnerable to Privilege Escalation via the View Admin As role switcher in versions 4.3.0 to 4.7.11. This is due to the stored original-role user meta (nxtext_view_admin_original_role) only being cleared on the profile_update hook. A role change made directly through WP_User::set_role(), such as the Users list bulk role change, does not fire that hook and leaves the meta in place. This makes it possible for an administrator who was demoted to a different role, such as subscriber, while temporarily viewing the site as a lower role to use the switcher's 'Switch back to Administrator' or reset-view link to get the Administrator role back. Exploitation requires that the account used the role switcher and was demoted while switched.

## References

- https://wpsec.com/vuln/WPSEC-2026-0944/
- https://plugins.svn.wordpress.org/nexter-extension/tags/4.7.12/
- https://wordpress.org/plugins/nexter-extension/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0944/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.