Skip to content
Threat Feed
Subscribe

Vendor

WP Grid Builder

1 brief RSS
high advisory

CVE-2026-13756 - Privilege Escalation in WP Grid Builder WordPress Plugin

An authenticated attacker with Subscriber-level access or higher can exploit a missing authorization and meta key validation vulnerability in the WP Grid Builder plugin for WordPress (versions up to and including 2.3.3) by sending a crafted nested array payload to the `/wp-json/wpgb/v2/metadata` REST endpoint, which allows them to update their own `wp_capabilities` user meta and effectively escalate their privileges to Administrator level.

WP Grid Builder plugin <= 2.3.3 privilege-escalation wordpress plugin cve
1r 1t 1c