CVE-2026-80338 Overview
CVE-2026-80338 is a missing authorization vulnerability [CWE-862] in the CMB2 WordPress plugin before version 2.13.0. The plugin fails to perform a capability check on one of its AJAX actions. Authenticated users with a role as low as Subscriber can create arbitrary WordPress options and corrupt existing ones. Corrupting core options can break site settings and take the site offline. Exploitation requires the active site or another plugin to declare an oEmbed field, since CMB2 registers none of its own. The stored value is not attacker-controlled, so the flaw does not enable privilege escalation.
Critical Impact
A Subscriber-level account can overwrite core WordPress options through an unprotected AJAX endpoint, disrupting site availability and integrity.
Affected Products
- CMB2 WordPress plugin versions prior to 2.13.0
- WordPress sites or plugins declaring an oEmbed field via CMB2
- Multisite and single-site WordPress installations running vulnerable CMB2 versions
Discovery Timeline
- 2026-09-24 - CVE CVE-2026-80338 published to NVD
- 2026-09-24 - Last updated in NVD database
Technical Details for CVE-2026-80338
Vulnerability Analysis
The vulnerability stems from a missing capability check on an AJAX action registered by CMB2. WordPress AJAX handlers are expected to call current_user_can() or equivalent authorization checks before performing privileged operations. The affected handler accepts requests from any authenticated user, including Subscribers, which is the lowest default role. Processing the request triggers the creation or overwrite of entries in the wp_options table. Corrupting options such as siteurl, home, template, or active_plugins can render the site unreachable or break administrative access.
The attack surface depends on an oEmbed field being declared through CMB2. The plugin ships no oEmbed fields of its own, so exploitability is bounded by the theme or other plugins active on the site. Because the attacker does not control the stored value, this is an integrity and availability issue rather than a path to code execution or privilege escalation.
Root Cause
The root cause is a Broken Access Control pattern [CWE-862]. The AJAX endpoint relies on authentication alone and omits a role or capability check. Any logged-in user can invoke the action and cause write operations against the options store.
Attack Vector
An attacker registers or compromises a Subscriber account on a target WordPress site. The attacker sends a crafted POST request to the admin-ajax.php endpoint invoking the vulnerable CMB2 action. If the site or another installed plugin declares an oEmbed field through CMB2, the handler writes to wp_options, overwriting existing keys or inserting new ones. Repeated or targeted writes against critical options take the site offline. See the WPScan Vulnerability Report for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-80338
Indicators of Compromise
- Unexpected POST requests to wp-admin/admin-ajax.php from Subscriber accounts referencing CMB2 AJAX actions
- Unexplained modifications or new rows in the wp_options table, especially to siteurl, home, template, or active_plugins
- Site outages or redirect loops following AJAX activity from low-privilege user sessions
- Spikes in new Subscriber registrations followed by AJAX traffic
Detection Strategies
- Audit WordPress access logs for admin-ajax.php requests originating from users with the Subscriber role
- Enable WordPress database query logging and alert on writes to wp_options outside administrative sessions
- Compare installed CMB2 plugin versions across managed sites against the fixed version 2.13.0
- Review theme and plugin code for oEmbed field declarations via CMB2 to identify exposed sites
Monitoring Recommendations
- Forward WordPress and web server logs to a centralized log platform for correlation across sites
- Baseline normal admin-ajax.php action frequency and alert on anomalous low-privilege activity
- Monitor WordPress core option integrity using file and database integrity tooling
- Track registration patterns for new Subscriber accounts followed by immediate AJAX requests
How to Mitigate CVE-2026-80338
Immediate Actions Required
- Update the CMB2 plugin to version 2.13.0 or later on all WordPress installations
- Inventory themes and plugins to identify any that declare oEmbed fields through CMB2
- Disable open user registration where Subscriber accounts are not required for site functionality
- Review wp_options for anomalous entries and restore corrupted values from backup if needed
Patch Information
Upgrade CMB2 to version 2.13.0 or later. The fixed release adds a capability check to the vulnerable AJAX action, blocking Subscriber-level users from invoking the write operation. Refer to the WPScan Vulnerability Report for upstream patch references.
Workarounds
- Temporarily disable the CMB2 plugin on sites that cannot be patched immediately
- Restrict access to admin-ajax.php for Subscriber accounts using a web application firewall rule
- Remove or disable themes and plugins that declare CMB2 oEmbed fields until patching is complete
- Close new user registration or require administrator approval for Subscriber accounts
# Example: WP-CLI update to the fixed version
wp plugin update cmb2 --version=2.13.0
wp plugin list --name=cmb2 --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
