VibeThemes VibeBP: Privilege escalation via arbitrary user meta updates (CVE-2026-16135)
The VibeBP plugin for WordPress is vulnerable to privilege escalation in versions up to 1.9.9.8.1, allowing authenticated attackers to grant themselves administrative rights.
CVE search metadata
CVE search record: CVE-2026-16135. Severity: high. CVSS: 8.8. KEV: no. Product: VibeBP (<= 1.9.9.8.1). Brief: VibeThemes VibeBP: Privilege escalation via arbitrary user meta updates (CVE-2026-16135). Brief link: https://feed.craftedsignal.io/briefs/2026-11-vibebp-privilege-escalation-cve-2026-16135/
Triage facts
Revision 1- Applicability
- VibeBP (<= 1.9.9.8.1)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 14:15 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Very likely
The VibeBP plugin for WordPress is vulnerable to a privilege escalation flaw (CVE-2026-16135) affecting all versions up to, and including, 1.9.9.8.1. The vulnerability stems from insecure implementation in the set_email_notification_settings() function, which fails to properly restrict arbitrary user meta updates. An authenticated attacker with Subscriber-level access can leverage this function to modify their own 'wp_capabilities' meta value to gain administrator privileges.
Impact
Successful exploitation allows an authenticated attacker to elevate their privileges to Administrator, potentially leading to full site compromise.
Recommendation
Review the VibeThemes changelog and update the VibeBP plugin to a version addressing CVE-2026-16135 immediately. Inventory all WordPress installations running the VibeBP plugin to prioritize remediation.
Immediate actions
Inventory WordPress environments for VibeBP plugin usage
Update VibeBP plugin to a version beyond 1.9.9.8.1 to remediate CVE-2026-16135
Threat Hunt
Search web server access logs for HTTP requests targeting the set_email_notification_settings() function or attempts to update user metadata
Data: Web server request logs