EUVD-2026-43118
GHSA-9qvw-92r9-h632
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable REST endpoint with no user interaction and low complexity, but requires an existing Subscriber account (PR:L); admin takeover yields full C/I/A impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the update() handler for the /wp-json/wpgb/v2/metadata REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by updating their own wp_capabilities user meta with a crafted nested array payload.
Articles & Coverage 1
AnalysisAI
Privilege escalation in the WP Grid Builder WordPress plugin (versions ≤ 2.3.3) lets an authenticated Subscriber-or-above user promote their own account to Administrator by sending a crafted nested-array payload to the /wp-json/wpgb/v2/metadata REST endpoint. The endpoint's update() handler lacks both an authorization check and meta-key validation, so an attacker can overwrite their own wp_capabilities user meta. No public exploit has been identified at time of analysis, and the flaw is not on CISA KEV; with CVSS 8.8 and low attack complexity, it is a high-priority patch for any site running this plugin.
Technical ContextAI
WP Grid Builder is a commercial WordPress plugin for building filterable/faceted content grids. The flaw lives in a custom WordPress REST API route (wpgb/v2/metadata) whose update() callback is intended to persist plugin metadata but performs neither a capability/permission check nor a whitelist of which meta keys may be written. This maps to CWE-269 (Improper Privilege Management): because arbitrary user_meta keys can be set, an attacker can target the special wp_capabilities meta that WordPress uses to store a user's role/capability map. Supplying a nested-array payload that sets administrator => true rewrites the caller's role. No CPE strings were supplied in the intelligence; the affected component is identified from the plugin slug and vendor changelog only.
RemediationAI
Update WP Grid Builder to the first release above 2.3.3 as published on the vendor changelog (https://docs.wpgridbuilder.com/changelog/); the input data does not name an exact patched version, so no vendor-released patch version is independently confirmed here - verify the fixed build against the changelog before deploying. If an immediate update is not possible, reduce exposure by disabling open user registration (Settings → General → uncheck 'Anyone can register') so attackers cannot obtain the Subscriber account the attack requires, and by restricting or blocking access to the /wp-json/wpgb/v2/metadata REST route at the WAF/reverse-proxy layer; note that blocking the route may break legitimate plugin metadata operations, so test grid functionality afterward. Monitor for unexpected changes to wp_capabilities/role assignments and audit existing accounts for unauthorized administrators. Refer to the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/6a42e0e8-a8c7-4bc5-80ca-5ef69d1f0b6c?source=cve) for detection guidance.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today