EUVD-2026-85795
GHSA-vf5h-xv4f-wc7g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRegister/obtain Subscriber account
-
DeliveryConfirm oEmbed CMB2 field present
-
ExploitInvoke unprotected CMB2 AJAX action
-
ExecutionCreate/corrupt arbitrary WP options
-
ImpactCore settings broken, site offline
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated WordPress user with a role as low as Subscriber (PR:L), and critically requires that the site - via CMB2 itself or, more realistically, another plugin/theme built on CMB2 - has declared an oEmbed field, because CMB2 registers none of its own. This non-default precondition is the primary limiting factor (reflected as AC:H) and means many CMB2 installs are not exploitable. No user interaction is needed. Impact is limited to integrity/availability (creating/corrupting WordPress options to break settings or take the site offline); the stored value is never attacker-controlled, so there is no confidentiality impact and no privilege escalation. |
| Impact | This is a genuine but bounded availability/integrity issue rather than a top-priority emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H, base 6.8) indicates a network-reachable flaw exploitable by any authenticated user as low as Subscriber (PR:L), with no confidentiality impact but high integrity and availability impact (corrupting/creating WordPress options can break core settings and take the site offline). The elevated AC:H reflects a real precondition: an oEmbed CMB2 field must already be declared by the site or another plugin, since CMB2 itself registers none. Exploitation signals are mixed and point AWAY from urgency: SSVC records Exploitation=none, Automatable=no, Technical Impact=partial, and there is no CISA KEV listing. Publicly available exploit code exists (WPScan), which raises opportunistic risk, but POC availability is distinct from active exploitation - there is no evidence of in-the-wild use. Net: a real, patch-now-on-normal-cadence issue for affected configurations, not a high-CVSS-but-fictional risk, yet materially constrained by the Subscriber-authentication requirement and the non-default oEmbed-field precondition. Note the CWE (CWE-862, missing authorization) and the description explicitly contradict the 'Privilege Escalation' tag, which should be disregarded. |
| Exploit ScenarioDerived | On a WordPress site where CMB2 (or another CMB2-dependent plugin) has declared an oEmbed field, an attacker registers or already holds a low-privilege Subscriber account and invokes the unprotected CMB2 AJAX action. Because no capability check is performed, they create or overwrite arbitrary WordPress options, corrupting core site settings and taking the site offline (denial of service). Public exploit code for this issue exists via WPScan, lowering the barrier to opportunistic abuse. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
Sites running the CMB2 WordPress plugin before 2.13.0 can have arbitrary WordPress options created or overwritten by any authenticated user holding a Subscriber-level account, because one of the plugin's AJAX actions performs no capability check; this can corrupt core site settings and render the site unusable. Exploitation is conditional: the site must have declared an oEmbed field - either through CMB2 itself or, far more commonly, through another plugin or theme built on CMB2 - since CMB2 registers no oEmbed fields of its own, and publicly available exploit code exists, though CISA SSVC records no known exploitation. The stored value is never attacker-controlled, so the impact is confined to integrity and availability (CVSS 6.8) with no confidentiality loss and no privilege escalation, and the vendor has released CMB2 2.13.0 as the fix.
RemediationAI
Update CMB2 to 2.13.0 (vendor-released patch), and because CMB2 is frequently bundled rather than installed directly, verify the version shipped inside every theme and plugin on the site rather than checking only the plugin list; details are in the WPScan advisory at https://wpscan.com/vulnerability/7402e0b0-54de-42b3-9032-ae225fb4e76a/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-80338. If immediate patching is impossible, the highest-value compensating control is to determine whether any installed component actually declares an oEmbed field - if none does, the vulnerable path is unreachable and the site is not exposed - and, where one is declared and cannot be removed, to disable that oEmbed field definition or the plugin providing it, accepting that the affected field will stop rendering. A WAF or application-level rule blocking the specific CMB2 AJAX action on admin-ajax.php from low-privilege accounts is a reasonable stopgap, but it can break legitimate oEmbed preview/rendering in the admin and must be tuned to avoid false positives. Additional hardening worth considering: temporarily tighten role assignments so untrusted users are not given even Subscriber accounts (impractical on membership sites that rely on self-registration), and monitor the wp_options table for unexpected inserts or updates, taking an offsite backup so that a corrupted option set can be restored without rebuilding the site. Escalation to privilege escalation or code execution is not warranted by this issue, so remediation effort should be prioritized relative to higher-impact findings.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CMB2 (Custom Metaboxes and Fields for WordPress) is a developer-facing library that themes and plugins bundle to build metaboxes, settings pages and repeatable field groups. The vulnerability is CWE-862 (Missing Authorization): one of CMB2's AJAX handlers, which participates in resolving oEmbed field values, never calls current_user_can() or an equivalent capability check before invoking update_option()/add_option() with option names derived from the request. WordPress AJAX actions are dispatched through the admin-ajax.php entry point, which is reachable by any authenticated session, so the missing check is what allows a Subscriber - the lowest standard role - to reach privileged option-writing logic (CVSS vector PR:L, AV:N). The high attack-complexity score (AC:H) is driven by a genuine non-default precondition: CMB2 ships no oEmbed field types itself, so the vulnerable code path exists only when the site, or another plugin/theme that uses CMB2, has declared an oEmbed field. The value written to the option is not attacker-controlled, which is why the vector shows no confidentiality impact (C:N) and why the issue does not chain into privilege escalation; the damage is limited to corrupting arbitrary option rows in the wp_options table, which can break core settings and take the site offline (I:H/A:H).
Know when Cmb2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Subscriber-level auth gives PR:L; the required pre-existing oEmbed field is a non-default precondition raising AC:H; no data disclosure (C:N) but option corruption yields I:H/A:H.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Stored cross-site scripting in the CMB2 WordPress plugin, affecting versions through 2.13.1, lets unauthenticated attack
Stored cross-site scripting (XSS) in the CMB2 WordPress library (all versions up to and including 2.13.0) allows unauthe
Cross-site scripting in the CMB2 WordPress plugin affects all versions up to and including 2.13.0, allowing an attacker
Exploit-DB