Security Alert Summary
The CMB2 WordPress plugin contains an insufficient-capability-check vulnerability in one of its AJAX actions. Users with a role as low as Subscriber can create or modify WordPress options when an oEmbed field from the site or another CMB2-based plugin is present, which can corrupt core settings and potentially take a site offline. The issue does not provide attacker-controlled stored values and does not lead to privilege escalation according to the published report.
CVE Details
- CVE ID: CVE-2026-80338
- Affected component: CMB2 WordPress plugin
- Affected versions: Versions before 2.13.0
- Published: September 24, 2026 at 6:17:01 AM UTC
- Last modified: September 24, 2026 at 2:42:02 PM UTC
- CVSS v3.1: Base score 6.8, MEDIUM —
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H - Authentication / privileges / user interaction: Requires an authenticated WordPress account with low privileges (description notes a role as low as Subscriber). Privileges required: Low. User interaction: None.
- Primary impact: Integrity: High; Availability: High; Confidentiality: None (per CVSS data)
- CWE / weakness: CWE-862 (Missing Authorization)
Technical Details
The plugin fails to perform a capability check on one of its AJAX actions. When a site or another CMB2-based plugin declares an oEmbed field (CMB2 itself registers none), this missing check allows authenticated users with low privileges to cause the creation of arbitrary WordPress options or corrupt existing options. Corrupting options can alter core site behavior or configuration, potentially breaking functionality or taking the site offline.
The stored option values involved are not attacker-controlled, and the advisory states this prevents privilege escalation. The vulnerability exists because the AJAX action does not verify the caller has appropriate capabilities before writing option data, effectively allowing low-privilege accounts to perform integrity-affecting actions under specific conditions (oEmbed field present).
How This Could Impact Your Website
Consider a small team managing a WordPress site: the site owner, an internal content editor, and an external contractor who contributes posts. If a contractor or a low-privilege user with a Subscriber account interacts with a CMB2-enabled form that uses an oEmbed field, they could trigger the vulnerable AJAX action and cause options to be created or overwritten. That could change site settings, break plugins or themes that rely on certain options, or render parts of the site unavailable until the options are corrected.
While the CVE indicates no direct confidentiality impact, corrupted configuration can indirectly increase operational risk. For example, downtime can disrupt business operations, and misconfigured pages or plugins could expose contact lists or other information depending on your site setup. This in turn can increase the risk of targeted phishing or social engineering against staff or contributors.
If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and external accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and logs for unusual option changes or unexpected AJAX requests.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
