WPBakery Page Builder plugin versions 8.7.2 and earlier contain a broken access control flaw. The vulnerability allows an authenticated user with the Subscriber role to perform actions that should be restricted to higher‑privileged users. This can lead to unauthorized modification of plugin configuration, which may impact the operation or appearance of the site.

The flaw affects installations of the WPBakery Page Builder plugin obtained from Rain‑Task Ltd. for WordPress. Any site running version 8.7.2 or older is potentially impacted. No other product components are mentioned in the vendor’s issue listing.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Attackers likely need to be logged in as a Subscriber or higher role to exploit the flaw, and the path does not require elevated privileges at installation time. Prompt remediation is advised to prevent unauthorized use of the plugin’s configuration capabilities.