CVE-2026-13756 is a privilege escalation vulnerability in the WP Grid Builder WordPress plugin affecting all versions up to 2.3.3. The vulnerability is due to insufficient authorization checks and lack of validation on the meta key in the update() handler for the /wp-json/wpgb/v2/metadata REST API endpoint. This allows authenticated attackers with low-level privileges (Subscriber and above) to elevate their privileges to Administrator by updating their wp_capabilities user meta with a specially crafted nested array payload. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to escalate their privileges to Administrator. This grants full administrative control over the WordPress site, potentially leading to complete site compromise, data theft, defacement, or further malicious activity.

No official patch or fix is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the REST endpoint if possible and monitor for suspicious activity from authenticated users. Avoid granting unnecessary Subscriber or higher privileges to untrusted users.