The CMB2 WordPress plugin before version 2.13.0 lacks capability checks on one of its AJAX actions. This missing authorization (CWE-862) permits low-privileged users (Subscriber role) to create arbitrary WordPress options or corrupt existing ones, which can break core site functionality and cause downtime. Exploitation requires the presence of an oEmbed field declared by the site or another CMB2 plugin, as the vulnerable plugin itself does not register any. The stored value involved is not attacker-controlled, so privilege escalation is not possible.

An attacker with Subscriber-level access can manipulate WordPress options, potentially corrupting site settings and causing the site to go offline. However, the vulnerability does not allow privilege escalation or direct control over stored values, limiting the scope of impact to denial of service or site disruption.

Upgrade the CMB2 WordPress plugin to version 2.13.0 or later, where this authorization issue is fixed. No other mitigation is indicated. Patch status is not explicitly confirmed in the input data, so verify with the vendor advisory for current remediation guidance.