CVE-2026-15293 describes an authorization bypass vulnerability in the WP Business Intelligence Lite plugin for WordPress, affecting all versions up to and including 3.2.0. The plugin fails to verify that users are authorized to perform certain actions, enabling authenticated users with Subscriber-level privileges or higher to alter stored SQL queries. This can result in privilege escalation through arbitrary SQL execution when an administrator subsequently views the manipulated queries. The vulnerability is classified under CWE-862 and has a CVSS 3.1 base score of 8.0, indicating a high impact on confidentiality, integrity, and availability. No vendor advisory or patch is currently available, and no known exploits are reported in the wild.

An attacker with authenticated access at Subscriber level or above can bypass authorization controls to modify stored SQL queries. This can lead to privilege escalation via arbitrary SQL execution when an administrator views the modified queries, potentially compromising the entire WordPress site’s confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict plugin usage to trusted users only and monitor for suspicious activity related to query modifications. Avoid granting Subscriber-level access to untrusted users. Stay alert for vendor updates or patches addressing this vulnerability.