CVE-2026-80338 Details
Description
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.
A vulnerability exists in the CMB2 WordPress plugin in versions prior to 2.13.0, where one of its AJAX actions lacks proper capability checks. This flaw allows users with a minimum role of Subscriber to create and modify WordPress options arbitrarily. Such actions can disrupt core site settings, potentially taking the site offline. The vulnerability can be exploited only if the site's theme or another plugin has declared an oEmbed field, as CMB2 does not register any oEmbed fields by default. Notably, the value stored through this vulnerability is not controlled by the attacker, so it does not lead to privilege escalation.
Users are advised to update the CMB2 WordPress plugin to version 2.13.0 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/7402e0b0-54de-42b3-9032-ae225fb4e76a/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| CMB2 | < 2.13.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |