CVE-2026-45436 Overview
CVE-2026-45436 is a broken access control vulnerability in the WPBakery Page Builder WordPress plugin (also known as js_composer) affecting versions up to and including 8.7.2. The flaw allows authenticated users with low-privilege Subscriber accounts to perform actions that should be restricted to higher-privileged roles such as Editor or Administrator. The weakness is tracked under CWE-862: Missing Authorization and reported via Patchstack.
Critical Impact
Any registered Subscriber on a vulnerable WordPress site can abuse plugin endpoints to modify content or plugin state, undermining the integrity of the site without requiring administrative credentials.
Affected Products
- WPBakery Page Builder (js_composer) versions <= 8.7.2
- WordPress sites that permit open user registration with the default Subscriber role
- Any WordPress instance where the plugin is active and not patched to a fixed release
Discovery Timeline
- 2026-06-17 - CVE-2026-45436 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-45436
Vulnerability Analysis
WPBakery Page Builder exposes plugin functionality through WordPress action handlers and AJAX endpoints. In versions through 8.7.2, one or more of these handlers fail to enforce a capability check appropriate to the action being performed. The plugin verifies that a request is authenticated but does not verify that the calling user holds the required role or capability.
This pattern aligns with CWE-862: Missing Authorization. The attacker only needs a valid session with Subscriber-level privileges, which is the default role assigned to self-registered users on many WordPress sites. The integrity impact is rated high while confidentiality and availability are not affected, indicating the flaw enables unauthorized state changes rather than data exfiltration or service disruption.
Root Cause
The root cause is the omission of a current_user_can() capability check (or an equivalent role gate) before privileged plugin actions are executed. The handler trusts that any authenticated nonce-bearing request is permitted, conflating authentication with authorization. Refer to the Patchstack advisory for vendor-confirmed technical specifics.
Attack Vector
Exploitation requires network access to the target WordPress site and a Subscriber-level account. The attacker authenticates, obtains any required nonce from publicly accessible pages or AJAX flows, and submits a crafted request to the vulnerable plugin endpoint. The endpoint executes the privileged action without confirming the caller has the necessary capability, allowing modification of plugin-managed content or settings.
No verified public proof-of-concept code is available for this CVE. See the linked Patchstack advisory for technical references.
Detection Methods for CVE-2026-45436
Indicators of Compromise
- Unexpected modifications to pages, posts, or page-builder templates performed by accounts assigned the Subscriber role.
- Subscriber-account HTTP POST requests to admin-ajax.php invoking WPBakery (vc_* or js_composer) actions.
- New or altered shortcodes, custom CSS, or template entries in WPBakery storage tables that are not attributable to Editor or Administrator activity.
Detection Strategies
- Inventory WordPress installations and identify any running WPBakery Page Builder at version <= 8.7.2.
- Review web server access logs for POST requests to wp-admin/admin-ajax.php with WPBakery-related action parameters originating from low-privilege users.
- Correlate WordPress audit logs against role assignments to flag content changes made by Subscriber accounts.
Monitoring Recommendations
- Enable a WordPress audit logging plugin and forward events to a centralized log platform for retention and correlation.
- Alert on any Subscriber-role account that triggers content-modification or plugin-configuration events.
- Monitor user registration spikes, which may indicate adversaries provisioning Subscriber accounts to exploit the flaw.
How to Mitigate CVE-2026-45436
Immediate Actions Required
- Update WPBakery Page Builder to a version later than 8.7.2 as soon as the vendor fix is available on your update channel.
- Audit existing user accounts and remove Subscriber accounts that were created during the exposure window and show no legitimate activity.
- If open registration is enabled, disable it temporarily until the plugin is patched.
Patch Information
Consult the Patchstack vulnerability record for the fixed-version reference and update the plugin through the WordPress admin dashboard or via WP-CLI. Verify the installed plugin version after the update completes.
Workarounds
- In wp-admin > Settings > General, uncheck "Anyone can register" to prevent attackers from self-provisioning Subscriber accounts.
- Deploy a Web Application Firewall rule that blocks unauthenticated and Subscriber-level requests to WPBakery AJAX actions until patching is complete.
- Restrict access to wp-admin/admin-ajax.php by IP allowlist where feasible, especially for staging or low-traffic production sites.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
