The WP Grid Builder plugin for WordPress contains a missing authorization check and lack of meta key validation in the update handler for the /wp-json/wpgb/v2/metadata REST endpoint. This flaw allows authenticated users with Subscriber-level access or higher to modify their own wp_capabilities meta field. By sending a crafted nested array payload, an attacker can elevate their privileges to Administrator, giving full control over the site. The vulnerability is identified as CWE-269, Privilege Escalation.

WordPress sites that have the WP Grid Builder plugin installed at any version up to and including 2.3.3 are affected. The issue arises from the REST endpoint within the plugin and is relevant for any installation that has the plugin enabled and the endpoint accessible.

The CVSS score of 8.8 indicates a high severity condition for this vulnerability. Although the EPSS score is less than 1%, implying a low current exploitation probability, the flaw remains significant because it only requires authenticated access with a Subscriber role, which is a common role in many sites. The vulnerability is not listed in the CISA KEV catalog, but the potential for privilege escalation warrants prompt remediation. Exploitation requires constructing a specific JSON payload targeting the wp_capabilities meta field via the exposed REST endpoint.