CVE-2026-13756: WP Grid Builder Privilege Escalation Flaw

CVE-2026-13756 Overview

CVE-2026-13756 is a privilege escalation vulnerability in the WP Grid Builder plugin for WordPress affecting all versions up to and including 2.3.3. The flaw resides in the update() handler for the /wp-json/wpgb/v2/metadata REST endpoint, which lacks authorization checks and meta key validation. Authenticated attackers with Subscriber-level access can elevate their privileges to Administrator by updating their own wp_capabilities user meta with a crafted nested array payload. The issue maps to CWE-269: Improper Privilege Management.

Critical Impact
Any authenticated user, including low-privilege Subscribers, can gain full Administrator control of the WordPress site, resulting in complete site takeover.

Affected Products

WP Grid Builder plugin for WordPress — all versions through 2.3.3
WordPress installations exposing the /wp-json/wpgb/v2/metadata REST endpoint
Sites permitting Subscriber-level or higher user registration

Discovery Timeline

2026-07-11 - CVE-2026-13756 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-13756

Vulnerability Analysis

The WP Grid Builder plugin registers a REST route at /wp-json/wpgb/v2/metadata used to update metadata records. The update() handler processes incoming JSON payloads and writes user meta values without verifying whether the caller is authorized to modify the target meta key. Because the handler accepts arbitrary meta keys and nested array values, an authenticated user can target the wp_capabilities meta key on their own account.

WordPress stores role assignments in the wp_capabilities user meta field as a serialized associative array (for example, {"administrator": true}). By submitting a crafted nested array payload to the endpoint, the attacker overwrites their role mapping and gains Administrator capabilities on the next request. This bypasses current_user_can() and map_meta_cap checks because those safeguards are never invoked in the vulnerable code path.

Root Cause

The root cause is a combination of missing authorization and missing input validation. The endpoint's permission_callback does not restrict access based on the caller's ability to edit the requested meta key, and the handler does not maintain an allowlist of permitted meta keys. Sensitive WordPress internals such as wp_capabilities, wp_user_level, and session_tokens are therefore writable by any authenticated user.

Attack Vector

Exploitation requires only a valid authenticated session at Subscriber level or above. The attacker sends an authenticated POST or PUT request to /wp-json/wpgb/v2/metadata with a JSON body containing the wp_capabilities key and a nested array setting administrator to true. No user interaction is required, and the attack is fully network-based. Because the target is the attacker's own user record, no other victim is needed to complete the exploit chain.

Verified proof-of-concept code is not published in the referenced advisories. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-13756

Indicators of Compromise

Unexpected POST or PUT requests to /wp-json/wpgb/v2/metadata originating from low-privilege user sessions.
Recent changes to wp_capabilities values in the wp_usermeta table for accounts that were not previously Administrators.
Newly created Administrator accounts or role changes that do not correlate with legitimate admin activity.
WordPress audit logs showing role escalations followed by plugin installs, theme edits, or edit_files capability use.

Detection Strategies

Inspect web server access logs for requests to the wpgb/v2/metadata REST route paired with authenticated cookies from non-admin users.
Query the wp_usermeta table for any recent updates to the wp_capabilities meta key and cross-reference with the responsible request.
Alert on WordPress set_user_role and add_user_role hook events that occur without a corresponding admin action in the audit trail.

Monitoring Recommendations

Enable a WordPress activity logging plugin that records role changes, REST API calls, and user meta updates.
Forward WordPress and web server logs to a centralized SIEM with alerting on privilege change events.
Monitor outbound traffic and file integrity for post-compromise behavior such as PHP file writes under wp-content and new scheduled cron entries.

How to Mitigate CVE-2026-13756

Immediate Actions Required

Update the WP Grid Builder plugin to a version later than 2.3.3 as soon as a patched release is available per the WP Grid Builder Changelog.
Audit all WordPress accounts and remove any Administrator users that cannot be attributed to legitimate personnel.
Rotate credentials, application passwords, and secret keys defined in wp-config.php if compromise is suspected.
Review installed plugins, themes, and mu-plugins directories for backdoors introduced after the vulnerability disclosure window.

Patch Information

The vendor tracks fixes in the WP Grid Builder Changelog. Apply the vendor-supplied update that addresses the missing authorization and meta key validation in the /wp-json/wpgb/v2/metadata REST handler. Confirm the patched version enforces a permission_callback requiring manage_options or an equivalent capability and rejects protected meta keys such as wp_capabilities and wp_user_level.

Workarounds

Restrict access to the /wp-json/wpgb/v2/metadata route at the web server or WAF layer until the plugin is patched.
Disable open user registration and set default_role to a value that cannot access the plugin's REST routes.
Deactivate the WP Grid Builder plugin if patching cannot be performed immediately and the functionality is not business-critical.
Add a custom rest_authentication_errors filter that blocks non-administrator requests to plugin-specific REST namespaces.

bash

# Example nginx location block to restrict the vulnerable endpoint
location ~ ^/wp-json/wpgb/v2/metadata {
    allow 203.0.113.10;   # trusted admin workstation
    deny all;
}