VIBEBP · CVE-2026-16135 · Other
FIX → 1.9.9.8.2
VibeBP for WordPress, up to and including 1.9.9.8.1, lets any logged-in user update arbitrary user meta through set_email_notification_settings(). A Subscriber can set their own wp_capabilities and become administrator. Fixed in 1.9.9.8.2 per Wordfence (CVSS 8.8).
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Any WordPress site running the VibeBP plugin at version 1.9.9.8.1 or lower where users can register or hold a Subscriber-level account is exposed. Sites without the plugin, or without any accounts that could be created or used by outsiders, are not affected.
Not affected if no-open-registration, no-user-registration, plugin-not-installed
Who cares privilege-escalation, vibebp, wordpress, wordpress-plugin
1.9.9.8.1 or lower is vulnerableUpgrade to 1.9.9.8.2
Update VibeBP to 1.9.9.8.2 or newer (per Wordfence).
The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to grant themselves administrator privileges by updating their own 'wp_capabilities' user meta value.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.