WP Grid Builder Plugin up to 2.3.3 on WordPress REST Endpoint metadata update wp_capabilities authorization

Summaryinfo

A vulnerability, which was classified as critical, was found in WP Grid Builder Plugin up to 2.3.3. This issue affects the function update of the file /wp-json/wpgb/v2/metadata of the component REST Endpoint. Executing a manipulation of the argument wp_capabilities can lead to authorization. This vulnerability is tracked as CVE-2026-13756. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability classified as critical was found in WP Grid Builder Plugin up to 2.3.3. This vulnerability affects the function update of the file /wp-json/wpgb/v2/metadata of the component REST Endpoint. The manipulation of the argument wp_capabilities with an unknown input leads to a authorization vulnerability. The CWE definition for the vulnerability is CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by updating their own `wp_capabilities` user meta with a crafted nested array payload.

The advisory is available at wordfence.com. This vulnerability was named CVE-2026-13756 since 06/29/2026. The exploitation appears to be easy. The attack can be initiated remotely. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 07/11/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• WordPress Plugin

Name

• WP Grid Builder Plugin

Version

• 2.3.0
• 2.3.1
• 2.3.2
• 2.3.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion