What is the CVSS score of CVE-2026-4261?

CVE-2026-4261 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Expire Users are affected by CVE-2026-4261?

A privilege escalation vulnerability in the Expire Users WordPress plugin (CVE-2026-4261) allows any authenticated user to gain administrator access, potentially compromising all WordPress…

How to fix or mitigate CVE-2026-4261?

Within 24 hours: Audit all WordPress installations to identify those running Expire Users plugin versions 1.2.2 or earlier and document affected systems. Within 7 days: Implement compensating controls (disable the plugin, apply WAF rules, or restrict user role management access) and monitor user privilege escalation logs. Within 30 days: Establish a vulnerability tracking process to monitor for patch availability and plan immediate deployment once released.

Expire Users CVE-2026-4261

EUVD-2026-14159 HIGH

Missing Authorization (CWE-862)

2026-03-21 Wordfence

GHSA-w7pq-j4cx-8r97

WordPress Authentication Bypass Privilege Escalation Expire Users Wordpress Plugin

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14159

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:27 nvd

HIGH 8.8

DescriptionCVE.org

The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a user to update the 'on_expire_default_to_role' meta through the 'save_extra_user_profile_fields' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.

AnalysisAI

The Expire Users plugin for WordPress versions up to and including 1.2.2 contains a privilege escalation vulnerability that allows authenticated users with Subscriber-level access or higher to elevate their privileges to administrator level. This occurs because the plugin improperly allows users to update the 'on_expire_default_to_role' meta field through the 'save_extra_user_profile_fields' function without proper authorization checks. With a CVSS score of 8.8 (High severity), this represents a critical security issue for affected WordPress installations, though no active exploitation (KEV) or EPSS data has been reported at this time.

Technical ContextAI

This vulnerability affects the Expire Users plugin (CPE: cpe:2.3:a:husobj:expire_users:*:*:*:*:*:*:*:*) developed by husobj for WordPress. The root cause is classified as CWE-862 (Missing Authorization), where the plugin fails to implement proper authorization checks in the 'save_extra_user_profile_fields' function located at admin/expire-user.php line 163. This function allows any authenticated user to modify user meta fields that control role assignment upon account expiration, specifically the 'on_expire_default_to_role' parameter. By manipulating this meta value, an attacker can designate themselves for administrator role assignment, bypassing WordPress's standard role-based access control mechanisms.

RemediationAI

Organizations should immediately upgrade the Expire Users plugin to a version newer than 1.2.2 that addresses this vulnerability, monitoring the WordPress plugin repository and vendor communications for patch availability. Refer to the Wordfence threat intelligence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d676700b-8c53-4e09-a654-767810b5a775?source=cve for the latest remediation guidance and patched version information. Until patching is completed, consider temporarily disabling the Expire Users plugin if it is not essential to operations, implementing Web Application Firewall (WAF) rules to monitor and block suspicious user profile update requests, restricting user registration to prevent attackers from obtaining subscriber accounts, and conducting an audit of existing user accounts to identify any unauthorized privilege escalations. Review WordPress user roles and permissions to ensure no subscriber or contributor accounts have been inappropriately elevated to administrator status.