CVE-2026-13756

🗓️ 11 Jul 2026 01:29:19Reported by WordfenceType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 34 Views🌐 WEB

Subscriber+ authenticated users can become Administrator by updating wp_capabilities via REST <=2.3.3.

Reporter	Title	Published	Views	Family All 7
ATTACKERKB	CVE-2026-13756	11 Jul 202601:29	–	attackerkb
Circl	CVE-2026-13756	11 Jul 202602:37	–	circl
Cvelist	CVE-2026-13756 WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter	11 Jul 202601:29	–	cvelist
EUVD	EUVD-2026-43118	11 Jul 202601:29	–	euvd
NVD	CVE-2026-13756	11 Jul 202602:16	–	nvd
Positive Technologies	PT-2026-57373	11 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-13756 WP Grid Builder <= 2.3.3 - Authenticated (Subscriber+) Privilege Escalation via 'key' Parameter	11 Jul 202601:29	–	vulnrichment

Vulners

Node

wp_grid_builder wp_grid_builderRange≤2.3.3wordpress

[
  {
    "vendor": "WP Grid Builder",
    "product": "WP Grid Builder",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "2.3.3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
docs	www.docs.wpgridbuilder.com/changelog/
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/6a42e0e8-a8c7-4bc5-80ca-5ef69d1f0b6c

Parameter	Position	Path	Description	CWE
wp_capabilities	request body	wp-json/wpgb/v2/metadata	Privilege escalation via unauthorized update to wp_capabilities through the /wp-json/wpgb/v2/metadata endpoint, allowing authenticated users with Subscriber access or higher to elevate to Administrator.	CWE-269

13 Jul 2026 17:17Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.18.8

EPSS0.003

SSVC

CWE-269