CVE-2026-13756

🗓️ 11 Jul 2026 01:29:19Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 61 Views🌐 WEB

Subscriber+ authenticated users can become Administrator by updating wp_capabilities via REST <=2.3.3.

Reporter	Title	Published	Views	Family All 9
attackerkb	CVE-2026-13756	11 Jul 202601:29	–	attackerkb
Circl	CVE-2026-13756	11 Jul 202602:37	–	circl
Cvelist	CVE-2026-13756 WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter	11 Jul 202601:29	–	cvelist
EUVD	EUVD-2026-43118	11 Jul 202601:29	–	euvd
NVD	CVE-2026-13756	11 Jul 202602:16	–	nvd
Patchstack	WordPress WP Grid Builder plugin <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation vulnerability	9 Sep 202613:19	–	patchstack
Positive Technologies	PT-2026-57373	11 Jul 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-13756: Improper Privilege Management	11 Jul 202600:00	–	rapid7
Vulnrichment	CVE-2026-13756 WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter	11 Jul 202601:29	–	vulnrichment

[
  {
    "vendor": "WP Grid Builder",
    "product": "WP Grid Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.3.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
docs	www.docs.wpgridbuilder.com/changelog/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/6a42e0e8-a8c7-4bc5-80ca-5ef69d1f0b6c

Parameter	Position	Path	Description	CWE
wp_capabilities	request body	/wp-json/wpgb/v2/metadata	Privilege escalation via missing authorization and meta key validation in the update handler of the WP Grid Builder /wp-json/wpgb/v2/metadata REST endpoint, allowing authenticated subscribers to elevate to Administrator by crafting a nested payload that updates their wp_capabilities.	CWE-269

13 Jul 2026 17:17Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.8

EPSS0.00442

SSVC

CWE-269