{"id":"CVE-2026-16135","kind":"vulnerability","aliases":["CVE-2026-16135"],"related":[],"title":"VibeBP WordPress plugin: subscribers can grant themselves administrator rights","description":"The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to grant themselves administrator privileges by updating their own 'wp_capabilities' user meta value.","summary":"VibeBP for WordPress, up to and including 1.9.9.8.1, lets any logged-in user update arbitrary user meta through set_email_notification_settings(). A Subscriber can set their own wp_capabilities and become administrator. Fixed in 1.9.9.8.2 per Wordfence (CVSS 8.8).","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"VibeBP","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"VibeBP","fixed":["1.9.9.8.2"],"affected":"<= 1.9.9.8.1","ecosystem":"wordpress"}],"ecosystems":["vendor"],"tags":["other","privilege-escalation","vibebp","wordpress","wordpress-plugin"],"not_affected_if":["no-open-registration","no-user-registration","plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, check the VibeBP version; 1.9.9.8.1 or lower is vulnerable. Or run: wp plugin get vibebp --field=version. Then review Users filtered to Administrator for accounts you do not recognise or Subscribers whose role recently changed.","fix":"Update VibeBP to 1.9.9.8.2 or newer (per Wordfence).","status":"open","published_at":"2026-11-12T12:18:24+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","triaged_at":"2026-11-12T12:40:29+00:00","updated_at":"2026-11-12T12:40:55+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-12T12:40:29Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"VibeBP WordPress plugin: subscribers can grant themselves administrator rights","impact":"high","summary":"The VibeBP plugin for WordPress lets any logged-in user update arbitrary user meta through set_email_notification_settings(). An attacker with a basic Subscriber account can set their own wp_capabilities value and become a WordPress administrator.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","vibebp"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker becomes WordPress administrator and controls the whole site","analyst_note":"Confirm the patched version of VibeBP from the WordPress plugin repository or the NVD page; the sources give no fixed version.","how_to_check":"- Check whether the VibeBP plugin is installed and its version is `1.9.9.8.1` or lower.\n- Review WordPress administrator accounts for unexpected users or recently changed roles.\n- unknown for any other check, the sources do not say.","plain_action":"","product_name":"VibeBP","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-open-registration"],"who_is_affected":"Any WordPress site running the VibeBP plugin at version `1.9.9.8.1` or lower where users can register or hold a Subscriber-level account is exposed. Sites without the plugin, or without any accounts that could be created or used by outsiders, are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000747,"input_tokens":4608,"output_tokens":572,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the patched version of VibeBP from the WordPress plugin repository or the NVD page; the sources give no fixed version.","search":"'-16135':12A,15A '-2026':11A,14A '1.9.9.8.1':34B,85C '1.9.9.8.2':63B '8.8':67B 'access':115C 'administr':8A,60B,121C 'allow':92C 'arbitrari':42B,93C 'attack':110C 'authent':109C 'becom':59B 'capabl':57B,128C 'cve':10A,13A 'cvss':66B 'due':88C 'email':47B,100C 'escal':21B,77C 'fix':61B 'function':103C 'grant':6A,119C 'includ':33B,84C 'let':35B 'level':114C 'log':38B 'logged-in':37B 'make':105C 'meta':44B,95C,130C 'notif':48B,101C 'per':64B 'plugin':3A,26B,70C,91C 'possibl':107C 'privileg':20B,76C,122C 'privilege-escal':19B 'right':9A 'set':46B,49B,53B,99C,102C 'subscrib':4A,51B,113C 'subscriber-level':112C 'updat':41B,96C,124C 'user':40B,43B,94C,129C 'valu':131C 'version':80C 'vibebp':1A,16A,17A,22B,27B,69C 'vulner':74C 'wordfenc':65B 'wordpress':2A,23B,25B,29B,72C 'wordpress-plugin':24B 'wp':56B,127C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the VibeBP plugin at version `1.9.9.8.1` or lower where users can register or hold a Subscriber-level account is exposed. Sites without the plugin, or without any accounts that could be created or used by outsiders, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["vibebp"],"ptokens":["vibebp"],"labels":["high","other","privilegeescalation","vendor","vibebp","wordpress","wordpressplugin"],"campaign_type":null,"search_a":"'-16135':12A,15A '-2026':11A,14A 'administr':8A 'cve':10A,13A 'grant':6A 'plugin':3A 'right':9A 'subscrib':4A 'vibebp':1A,16A,17A 'wordpress':2A","search_b":"'1.9.9.8.1':34B '1.9.9.8.2':63B '8.8':67B 'administr':60B 'arbitrari':42B 'becom':59B 'capabl':57B 'cvss':66B 'email':47B 'escal':21B 'fix':61B 'includ':33B 'let':35B 'log':38B 'logged-in':37B 'meta':44B 'notif':48B 'per':64B 'plugin':26B 'privileg':20B 'privilege-escal':19B 'set':46B,49B,53B 'subscrib':51B 'updat':41B 'user':40B,43B 'vibebp':22B,27B 'wordfenc':65B 'wordpress':23B,25B,29B 'wordpress-plugin':24B 'wp':56B","search_c":"'1.9.9.8.1':85C 'access':115C 'administr':121C 'allow':92C 'arbitrari':93C 'attack':110C 'authent':109C 'capabl':128C 'due':88C 'email':100C 'escal':77C 'function':103C 'grant':119C 'includ':84C 'level':114C 'make':105C 'meta':95C,130C 'notif':101C 'plugin':70C,91C 'possibl':107C 'privileg':76C,122C 'set':99C,102C 'subscrib':113C 'subscriber-level':112C 'updat':96C,124C 'user':94C,129C 'valu':131C 'version':80C 'vibebp':69C 'vulner':74C 'wordpress':72C 'wp':127C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T12:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16135","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16135","severity":null,"published_at":"2026-11-12T12:18:24+00:00","modified_at":"2026-11-12T12:18:24+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","fetched_at":"2026-11-12T12:38:18+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16135:3731","url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vibebp/vibebp-19981-authenticated-subscriber-privilege-escalation-in-set-email-notification-settings","severity":null,"published_at":"2026-11-12T12:40:55+00:00","modified_at":"2026-11-12T12:40:55+00:00","first_seen_at":"2026-11-12T12:40:55+00:00","fetched_at":"2026-11-12T12:40:55+00:00","note":"Wordfence (CNA) advisory: affected <=1.9.9.8.1, fixed 1.9.9.8.2. No vendor page (sold via ThemeForest), so nothing marked verified. No exploitation or PoC seen.","cites":["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vibebp/vibebp-19981-authenticated-subscriber-privilege-escalation-in-set-email-notification-settings"]}],"documents":[{"id":134868,"url":"https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vibebp/vibebp-19981-authenticated-subscriber-privilege-escalation-in-set-email-notification-settings","title":"Wordfence: VibeBP <= 1.9.9.8.1 Subscriber+ Privilege Escalation","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}