CVE-2026-13756

Name of the Vulnerable Software and Affected Versions WP Grid Builder versions prior to 2.3.4

Description An issue exists where missing authorization and meta key validation in the update() handler for the '/wp-json/wpgb/v2/metadata' REST endpoint allows authenticated users with Subscriber-level access or higher to elevate their privileges to Administrator. This is achieved by updating the wp capabilities user meta using a crafted nested array payload.

Recommendations Update WP Grid Builder to version 2.3.4 or later. Restrict access to the '/wp-json/wpgb/v2/metadata' REST endpoint to minimize the risk of exploitation.