CVE-2026-5093 in Greenshift Plugin
Summary
by MITRE • 08/22/2026
The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_settings' function that only verifies the 'edit_posts' capability instead of requiring administrative privileges. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global WordPress theme color settings site-wide, leading to site defacement.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/22/2026
The GreenShift – Animation and Page Builder Blocks plugin for WordPress contains a critical authorization flaw in versions up through 12.8.9 that allows authenticated users with low-privilege accounts to perform administrative actions. The vulnerability stems from the 'gspb_update_global_wp_settings' function, which is responsible for updating global theme configuration data across the entire website. Instead of enforcing strict capability checks appropriate for site-wide modifications, the code incorrectly verifies only the 'edit_posts' capability. In WordPress role hierarchies, this permission is granted to contributors and authors by default, meaning any user who can create or edit content on the site possesses the necessary credentials to exploit this flaw without needing elevated administrative privileges.
This architectural oversight results in a Broken Access Control vulnerability that fundamentally undermines the principle of least privilege within the application environment. By allowing non-administrative users to modify global settings, the plugin bypasses standard security boundaries designed to protect core system configurations from lower-level actors. The specific impact involves the ability for these attackers to alter global WordPress theme color settings, which affects the visual presentation and branding elements applied site-wide rather than just within a single post or page. This capability transforms what should be a minor configuration change into a mechanism for widespread site defacement, as an attacker can systematically overwrite design assets visible to all visitors of the website.
From an operational perspective, this vulnerability poses significant risks regarding data integrity and brand reputation. Site defacement is not merely a cosmetic issue; it indicates that critical system parameters are accessible to unauthorized parties, suggesting potential pathways for further exploitation or persistent backdoors if similar patterns exist elsewhere in the plugin codebase. The ability to change global theme colors can be used to display malicious content, disrupt user experience intentionally, or degrade trust in the website's legitimacy among its audience. Such actions can lead to immediate reputational damage and require extensive remediation efforts to restore original configurations and verify that no other settings have been tampered with during the attack window.
To mitigate this risk, site administrators must immediately update the GreenShift plugin to a version later than 12.8.9 where the capability check has been corrected to require 'manage_options' or equivalent administrative privileges for global setting modifications. Until an official patch is available, it is advisable to restrict access to WordPress admin areas by limiting user roles and auditing existing accounts with contributor-level permissions or higher. Security teams should also monitor server logs for unusual requests targeting the specific endpoint associated with this function to detect potential exploitation attempts in real time. Implementing a Web Application Firewall can provide an additional layer of defense by blocking unauthorized API calls that attempt to modify global configuration parameters without proper authentication tokens.
This vulnerability aligns with Common Weakness Enumeration identifier CWE-269, which covers Improper Privilege Management, specifically the failure to enforce role-based access controls correctly. It also maps directly to MITRE ATT&CK technique T1078, Valid Accounts, as it relies on legitimate but insufficiently privileged credentials to achieve unauthorized administrative actions. Understanding this mapping helps security professionals categorize the threat accurately within broader incident response frameworks and ensures that similar authorization flaws in other plugins are identified through targeted code reviews focusing on capability verification logic rather than just input validation or injection vulnerabilities.