Cpe:2.3:a:vibethemes:vibebp:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3avibethemesvibebp/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 12 Nov 2026 14:15:29 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgVibeThemes VibeBP: Privilege escalation via arbitrary user meta updates (CVE-2026-16135)https://feed.craftedsignal.io/briefs/2026-11-vibebp-privilege-escalation-cve-2026-16135/Thu, 12 Nov 2026 14:15:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-vibebp-privilege-escalation-cve-2026-16135/The VibeBP plugin for WordPress is vulnerable to privilege escalation in versions up to 1.9.9.8.1, allowing authenticated attackers to grant themselves administrative rights.The VibeBP plugin for WordPress is vulnerable to a privilege escalation flaw (CVE-2026-16135) affecting all versions up to, and including, 1.9.9.8.1. The vulnerability stems from insecure implementation in the set_email_notification_settings() function, which fails to properly restrict arbitrary user meta updates. An authenticated attacker with Subscriber-level access can leverage this function to modify their own 'wp_capabilities' meta value to gain administrator privileges.

Impact

Successful exploitation allows an authenticated attacker to elevate their privileges to Administrator, potentially leading to full site compromise.

Recommendation

Review the VibeThemes changelog and update the VibeBP plugin to a version addressing CVE-2026-16135 immediately. Inventory all WordPress installations running the VibeBP plugin to prioritize remediation.

]]>highadvisory