---
id: "CVE-2026-16135"
page: "https://infrastack.ai/live/CVE-2026-16135"
kind: "vulnerability"
aliases: ["CVE-2026-16135"]
title: "VibeBP WordPress plugin: subscribers can grant themselves administrator rights"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "VibeBP", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "VibeBP", "fixed": ["1.9.9.8.2"], "affected": "<= 1.9.9.8.1", "ecosystem": "wordpress"}]
ecosystems: ["vendor"]
tags: ["other", "privilege-escalation", "vibebp", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-open-registration", "no-user-registration", "plugin-not-installed"]
published_at: "2026-11-12T12:18:24+00:00"
first_seen_at: "2026-11-12T12:38:18+00:00"
updated_at: "2026-11-12T12:40:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16135", "first_seen_at": "2026-11-12T12:38:18+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vibebp/vibebp-19981-authenticated-subscriber-privilege-escalation-in-set-email-notification-settings", "first_seen_at": "2026-11-12T12:40:55+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vibebp/vibebp-19981-authenticated-subscriber-privilege-escalation-in-set-email-notification-settings"]}]
exploit_sources: []
---

# VibeBP WordPress plugin: subscribers can grant themselves administrator rights

Link for people: https://infrastack.ai/live/CVE-2026-16135 (this .md is for agents)

VibeBP for WordPress, up to and including 1.9.9.8.1, lets any logged-in user update arbitrary user meta through set_email_notification_settings(). A Subscriber can set their own wp_capabilities and become administrator. Fixed in 1.9.9.8.2 per Wordfence (CVSS 8.8).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:VibeBP affected range not listed fixed no fixed version listed
- wordpress:VibeBP affected <= 1.9.9.8.1 fixed 1.9.9.8.2

## How to check

In WordPress admin > Plugins, check the VibeBP version; 1.9.9.8.1 or lower is vulnerable. Or run: wp plugin get vibebp --field=version. Then review Users filtered to Administrator for accounts you do not recognise or Subscribers whose role recently changed.

## Fix

Update VibeBP to 1.9.9.8.2 or newer (per Wordfence).

## Timeline

- 2026-11-12T12:38:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16135
- 2026-11-12T12:40:55+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vibebp/vibebp-19981-authenticated-subscriber-privilege-escalation-in-set-email-notification-settings — Wordfence (CNA) advisory: affected <=1.9.9.8.1, fixed 1.9.9.8.2. No vendor page (sold via ThemeForest), so nothing marked verified. No exploitation or PoC seen.

## Documents

- [advisory] Wordfence: VibeBP <= 1.9.9.8.1 Subscriber+ Privilege Escalation https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/vibebp/vibebp-19981-authenticated-subscriber-privilege-escalation-in-set-email-notification-settings

## From the sources

The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to grant themselves administrator privileges by updating their own 'wp_capabilities' user meta value.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_