CVE-2026-80338

Name of the Vulnerable Software and Affected Versions CMB2 WordPress plugin versions prior to 2.13.0

Description An issue exists where a lack of capability checks on an AJAX action allows users with Subscriber roles to create or corrupt arbitrary WordPress options. This can lead to the disruption of core site settings and potential site downtime. Exploitation is possible only if the site or another plugin using CMB2 has declared an oEmbed field, as the plugin does not register any by default. Since the stored value is not attacker-controlled, this issue does not allow for privilege escalation.

Recommendations Update CMB2 WordPress plugin to version 2.13.0 or later.