CVE-2026-80338: CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
Sites using CMB2 versions before 2.13.0 are exposed only if the site itself or another plugin using CMB2 has declared an oEmbed field. CMB2 does not declare an oEmbed field on its own, so installations without such a field do not meet the stated exploitation condition.
What access does an attacker need?
An attacker needs an authenticated WordPress account with at least the Subscriber role. The vulnerable AJAX action lacks a capability check.
What can exploitation do?
A low-privileged user can create arbitrary WordPress options or corrupt existing options. This can disrupt core site settings and potentially take the site offline, but the stored value is not attacker-controlled and the issue does not provide privilege escalation.
How can I determine whether my site is affected?
Check whether CMB2 is below version 2.13.0 and whether your site or another CMB2-using plugin declares an oEmbed field. Both conditions are required for the described exploitation path.