posimyththemes Nexter Extension Plugin up to 4.7.11 on WordPress View Admin Role Switcher wp-admin/users.php role_switcher_to_view_admin_as reset-view/action privileges management

Summaryinfo

A vulnerability described as critical has been identified in posimyththemes Nexter Extension Plugin up to 4.7.11. Affected is the function role_switcher_to_view_admin_as of the file wp-admin/users.php of the component View Admin Role Switcher. Executing a manipulation of the argument reset-view/action can lead to privileges management. This vulnerability is registered as CVE-2026-111114. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability was found in posimyththemes Nexter Extension Plugin up to 4.7.11. It has been declared as critical. This vulnerability affects the function role_switcher_to_view_admin_as of the file wp-admin/users.php of the component View Admin Role Switcher. The manipulation of the argument reset-view/action with an unknown input leads to a privileges management vulnerability. The CWE definition for the vulnerability is CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Nexter Extension – Security, Performance, Code Snippets & Site Toolkit plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.7.11 The vulnerability exists because the `/?reset-view` handler in `role_switcher_to_view_admin_as()` performs no nonce or capability check when the supplied username matches the authenticated caller, and because the plugin's only cleanup mechanism — the `profile_update` hook — does not fire when WordPress performs a bulk role change via `wp-admin/users.php?action=promote`, which calls `WP_User::set_role()` directly and leaves a stale `administrator` value in the `nxtext_view_admin_original_role` user meta. This makes it possible for authenticated attackers with Subscriber-level access or above to restore the stale stored Administrator role to their own account, effectively escalating their privileges to Administrator. Exploitation requires that the attacker's account previously held the Administrator role and used the View Admin Role Switcher feature before being demoted specifically through the bulk role-change control rather than the Edit User screen, as only the bulk path bypasses the `profile_update` hook that would otherwise have cleared the stored original role.

The advisory is available at wordfence.com. This vulnerability was named CVE-2026-111114 since 10/15/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/16/2026). This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

By approaching the search of inurl:wp-admin/users.php it is possible to find vulnerable targets with Google Hacking.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Vendor

• posimyththemes

Name

• Nexter Extension Plugin

Version

• 4.7.0
• 4.7.1
• 4.7.2
• 4.7.3
• 4.7.4
• 4.7.5
• 4.7.6
• 4.7.7
• 4.7.8
• 4.7.9
• 4.7.10
• 4.7.11

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion