CVE-2026-111114 in Nexter Extension Plugin
Summary
by MITRE • 10/16/2026
The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/16/2026
The Nexter Extension plugin for WordPress contains a critical privilege escalation vulnerability affecting all versions up to and including 4.7.11. This flaw allows authenticated attackers with Subscriber-level access or higher to escalate their privileges to Administrator level under specific conditions. The root cause lies in the improper handling of role switching functionality, specifically within the `role_switcher_to_view_admin_as()` function which processes requests via the `/reset-view` handler. When a user attempts to reset their view to an administrator interface, the plugin fails to verify nonces or check current capabilities against the requested action if the supplied username matches the authenticated caller. This lack of authorization checks creates a direct path for privilege escalation when combined with other state management failures within the WordPress core interaction model.
The vulnerability is exacerbated by how the plugin manages user metadata during role changes. The plugin relies on the `profile_update` hook to clean up stale data, specifically the `nxtext_view_admin_original_role` meta value that stores the original role before a switch occurs. However, this cleanup mechanism fails when WordPress performs bulk role changes through the standard administration interface at `/wp-admin/users.php?action=promote`. This specific endpoint calls `WP_User::set_role()` directly, bypassing the hooks that would normally trigger the plugin's cleanup logic. Consequently, if an administrator previously used the View Admin Role Switcher feature and was subsequently demoted via this bulk action, the stale Administrator role value remains stored in their user metadata without being cleared.
Exploitation of this vulnerability requires a specific sequence of events involving prior administrative access. An attacker must have held the Administrator role at some point and utilized the plugin's view switching feature while logged in as an administrator. Following this, they must be demoted to a lower privilege level, such as Subscriber or Editor, specifically through the bulk user management interface rather than the individual Edit User screen. Once these conditions are met, the attacker can send a crafted request to the `/reset-view` endpoint with their own username. Because the plugin does not validate that the current session has sufficient privileges to perform this action and because the stale metadata persists due to the bypassed cleanup hook, the system restores the stored Administrator role to the attacker's account. This effectively grants full administrative control back to a user who should only have limited access.
From a technical classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. The failure to verify that the authenticated user has the necessary permissions before executing a role restoration constitutes a classic authorization bypass. In terms of attack vectors, this maps to MITRE ATT&CK technique T1078 Valid Accounts, specifically within the context of local account manipulation where an attacker leverages valid credentials and existing session state to gain higher-level access. The exploitation does not require remote code execution or SQL injection but relies entirely on logical flaws in how role states are persisted and validated during administrative operations.
Mitigation strategies should focus on immediate patching and defensive coding practices. Users running versions of the Nexter Extension up to 4.7.11 must update to a patched version that addresses these authorization checks immediately. Developers implementing similar functionality should ensure that all state-changing actions, particularly those involving privilege modifications or role switches, enforce strict nonce verification and capability checks regardless of whether the target user matches the current session owner. Furthermore, cleanup logic for temporary metadata must be decoupled from specific hooks like `profile_update` if alternative code paths such as bulk operations exist in WordPress core that bypass them. Implementing explicit validation at every step of role transition ensures that stale data cannot be exploited to restore unauthorized privileges.