The VibeBP WordPress plugin contains a privilege escalation vulnerability in all versions up to and including 1.9.9.8.1. Authenticated users with Subscriber-level access or higher can exploit this flaw by manipulating the set_email_notification_settings() function to update their own 'wp_capabilities' user meta value, thereby granting themselves administrator privileges.