CVE-2026-80338
📛 CVE Title
CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler
Description
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.
Overview
- State
- PUBLISHED
- Assigner (CNA)
- WPScan
- CVSS severity
- —
- CVSS score
- —
- CVSS vector
- —
- Effective score
- no score available from CNA, NVD, or AI yet
- CWE(s)
-
CWE-862 Missing Authorization - Reserved
- 2026-08-26
- Published
- 2026-09-24 06:00 UTC
- Last updated
- 2026-09-24 10:41 UTC
- Source
- https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/80xxx/CVE-2026-80338.json
NVD triage scoring NVD CVE 2.0
Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.
- EPSS score
- 0.0013 (probability of exploitation in next 30 days)
- EPSS percentile
- 2.27% vs all CVEs — higher = more likely to be exploited, as of 2026-09-24
NVD / KEV / EPSS data refreshed 2026-09-25 04:36 UTC. Re-run the 🛰 Backfill from NVD button above to refresh.
AI-forensic CVSS estimate
Used only when a CVE has no official CVSS from its CNA or NVD. An LLM estimates the v3.1 base score from the description; a HIGH/CRITICAL estimate promotes the CVE to a Threat.
No AI estimate yet — it runs automatically once NVD has been checked, or click the button above.
European Union Vulnerability Database ENISA EUVD
ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.
- EUVD ID
-
EUVD-2026-85795 - Assigner
- WPScan
- Published
- Sep 24, 2026, 6:00:16 AM
- Updated
- Sep 24, 2026, 10:41:56 AM
- EUVD base score (CVSS 3.1)
-
6.8 / 10
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H - EUVD-reported EPSS
- 0.1300
- Vendors
- Unknown
- Products
-
CMB2 (0 <2.13.0)
- Aliases
-
GHSA-vf5h-xv4f-wc7g
ENISA description: The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline. Exploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation.
EUVD references (1)
Affected products (1)
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| Unknown | CMB2 |
0 (affected)
|
— |
Vendor references (1)
References embedded in the original CVE record by the assigning CNA.
- https://wpscan.com/vulnerability/7402e0b0-54de-42b3-9032-ae225fb4e76a/ exploitvdb-entrytechnical-description
Web references (0)
DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.
No web references attached yet.
Remediations (10)
-
web:app.opencve.io
NVD Status : Received Published: 2026 -09-24T06:17:01.317 Modified: 2026 -09-24T06:17:01.317 Link: CVE-2026-80338 Redhat
2026-09-25 10:46 UTC -
web:feedly.com
CVE assignment NVD published the first details for CVE-2026-80338
2026-09-25 10:46 UTC -
web:msrc.microsoft.com
Security Update Guide - Microsoft Security Response Center
2026-09-25 10:46 UTC -
web:senserva.com
Every Microsoft security patch (KB) and the CVEs it fixes, with severity, CVSS, and CISA KEV status. Cross-linked to the CVE reference.
2026-09-25 10:46 UTC -
web:support.microsoft.com
Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016. It doesn't apply to the Office 2016 Click-to-Run editions, such as Microsoft Office 365 Home. (See What version of Office am I using?) How to get and install the update Method 1: Microsoft Update This update is available from Microsoft Update. When you turn on ...
2026-09-25 10:46 UTC -
web:vulmon.com
Vulnerability Summary CMB2 WordPress plugin versions prior to 2.13.0 enable users with a Subscriber role to create or corrupt WordPress options. This can lead to core site settings being broken and the site becoming unavailable. Exploitation is dependent on the presence of an oEmbed field declared by the site or another CMB2 plugin, as CMB2 itself registers no such fields. The flaw does not ...
2026-09-25 10:46 UTC -
web:www.cisecurity.org
<p>Multiple vulnerabilities have been discovered in Microsoft products, the most severe of which could allow for remote code execution. Successful exploitation of the most severe of these vulnerabilities could result in an attacker gaining the same privileges as the logged-on user. Depending on the privileges associated with the user, an attacker could then install programs; view, change, or ...
2026-09-25 10:46 UTC -
web:www.rapid7.com
CVE-2026-80338 : Unknown CMB2: The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing…. View severity, references, and remediation details from Rapid7.
2026-09-25 10:46 UTC -
web:www.tenable.com
The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create ...
2026-09-25 10:46 UTC -
web:www.theregister.com
If you use WordPress, patch now. Just hours after fixes came out, attackers have begun exploiting two bugs that, when chained together, allow pre-authentication remote code execution (RCE). And security researchers tell us there's a very good chance the miscreants had an AI assist. "Once the vulnerabilities were publicly disclosed, reproducing them with the help of frontier AI models was ...
2026-09-25 10:46 UTC
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.
Raw JSON
The full cvelistV5 record. Download as CVE-2026-80338.json.
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-80338",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-24T10:37:26.261371Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T10:41:56.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "CMB2",
"vendor": "Unknown",
"versions": [
{
"lessThan": "2.13.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mutantgun"
},
{
"lang": "en",
"type": "coordinator",
"value": "WPScan"
}
],
"descriptions": [
{
"lang": "en",
"value": "The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core site settings and take the site offline.\nExploitation requires the site's or another CMB2 WordPress plugin before 2.13.0 to have declared an oEmbed field, as the CMB2 WordPress plugin before 2.13.0 registers none of its own. The stored value is never attacker-controlled, so the issue does not lead to privilege escalation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-24T06:00:16.288Z",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"exploit",
"vdb-entry",
"technical-description"
],
"url": "https://wpscan.com/vulnerability/7402e0b0-54de-42b3-9032-ae225fb4e76a/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler",
"x_generator": {
"engine": "WPScan CVE Generator"
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2026-80338",
"datePublished": "2026-09-24T06:00:16.288Z",
"dateReserved": "2026-08-26T09:02:21.818Z",
"dateUpdated": "2026-09-24T10:41:56.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}