CVE-2026-13756Disclosure

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by updating their own `wp_capabilities` user meta with a crafted nested array payload.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-269

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-13756/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters92d
Disclosure
#CVE-2026-13756 - #Privilege Escalation in #WP Grid Builder plugin. Subscriber+ can become Admin via REST #API flaw. #CVSS 8.8. No patch available. Disable or restrict access immediately. #CVEAlert #WordPress #infosec #devsecops #devops #developers #sysadmin #git #github #gitlab https://www.valtersit.com/cve/CVE-2026-13756/
Post summary
The post announces CVE-2026-13756, a privilege‑escalation flaw in WP Grid Builder that allows subscribers to become admins via a REST API breach, cites a CVSS score of 8.8, and advises disabling or limiting access due to the lack of an available patch, but provides no PoC or exploit.
00010117
978 followersView on X

Explore more

Back to dashboard