WP Grid Builder CVE-2026-13756

Requires a valid authenticated account at Subscriber level or above (PR:L) - the primary limiting factor, so sites without open/self-service user registration are substantially harder to exploit. The attack targets the specific REST endpoint /wp-json/wpgb/v2/metadata and abuses its update() handler, which must be reachable over the network (AV:N); the crafted request must set the wp_capabilities user meta via a nested-array payload. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Exploitation is limited to sites running WP Grid Builder version 2.3.3 or earlier; sites that disable registration, restrict REST API access, or have already updated are not exposed.

Signals are largely consistent toward a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity attack needing only low privileges and no user interaction, yielding full confidentiality/integrity/availability impact via a resulting admin takeover. The one meaningful barrier is PR:L: the attacker must already hold a valid low-level account (Subscriber+), so exposure is highest on sites permitting open or self-service registration and lower on closed sites. No EPSS score, KEV entry, SSVC decision, or POC was provided in the intelligence, so widespread automated exploitation cannot be confirmed - the absence of these signals is a data gap, not evidence of low risk. Reported by Wordfence, the finding is credible; treat as high priority especially where user registration is enabled.

An attacker registers (or acquires) a Subscriber account on a WordPress site running WP Grid Builder ≤ 2.3.3, then sends an authenticated POST to /wp-json/wpgb/v2/metadata with a crafted nested-array payload that writes administrator => 1 into their own wp_capabilities user meta. Because the update() handler skips authorization and meta-key validation, the account is instantly elevated to Administrator, granting full site control including plugin/theme editing and PHP code execution. No public POC was identified at time of analysis, but the low complexity (AC:L) makes weaponization straightforward.