CVE-2026-16135
VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The VibeBP plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.9.9.8.1. This is due to the plugin allowing arbitrary user meta updates through the set_email_notification_settings() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to grant themselves administrator privileges by updating their own 'wp_capabilities' user meta value.
| CWE | CWE-269 |
| Vendor | vibethemes |
| Product | vibebp |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for vibethemes vibebp
Be the first to know when new high vulnerabilities affecting vibethemes vibebp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
VibeThemes / VibeBP
0 ≤ 1.9.9.8.1
References
Credits
d.v4n_s3c