CVE-2026-16135: VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()
The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the setemailnotificationsettings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to grant themselves administrator privileges by updating their own 'wpcapabilities' user meta value.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with at least Subscriber-level access can exploit it. An attacker does not need administrator privileges or user interaction.
What access can an attacker gain?
A qualifying authenticated user can update their own wp_capabilities user meta value and grant themselves administrator privileges. This can result in complete compromise of the affected WordPress site.
Which versions are affected?
All VibeBP versions up to and including 1.9.9.8.1 are affected.
How can I check whether exploitation may have occurred?
Review WordPress user accounts and user meta for unexpected changes to the wp_capabilities value, particularly Subscriber or other low-privileged accounts that now have administrator capabilities.