CVE-2026-45436

Executive Summary

CVE-2026-45436 is a Subscriber Broken Access Control vulnerability in the WPBakery Page Builder plugin for WordPress, affecting versions up to and including 8.7.2. This flaw allows authenticated users with Subscriber-level privileges to perform actions that should be restricted to higher-tier roles (e.g., Editor, Administrator). The vulnerability stems from improper authorization checks in AJAX handlers and REST API endpoints, enabling privilege escalation and unauthorized modification of page content.

Given that this is a WordPress plugin vulnerability, the attack surface is limited to sites running the vulnerable plugin. The EPSS score of 0.0% indicates no active exploitation in the wild, but the risk remains significant for sites with untrusted Subscriber accounts. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. WPBakery Page Builder is a commercial plugin distributed via the vendor's website and bundled with many premium themes. Users should verify their plugin version and apply any available updates from the vendor. Since no patch exists, mitigation relies on disabling the plugin or restricting Subscriber access.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Subscriber role
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. Exploitation requires an authenticated Subscriber account, limiting the attack surface. However, the lack of a patch and the widespread use of WPBakery make this a concern for multi-tenant WordPress installations.

Deep Dive & Mechanics

The vulnerability exists in the plugin's AJAX and REST API handlers that process page builder actions. Specifically, the wpb_get_element_backend_editor and wpb_save_element endpoints fail to verify that the current user has the required capabilities (e.g., edit_posts, edit_others_posts). A Subscriber can send crafted requests to:

1. Retrieve backend editor data for any post/page, including drafts and private content.
2. Modify page content by injecting malicious shortcodes or altering existing elements.
3. Trigger stored XSS by inserting JavaScript into page builder elements that are rendered for other users.

The root cause is a missing current_user_can() check in the plugin's core AJAX functions. For example, the wpb_save_element function directly calls update_post_meta() without verifying the user's role.

Vulnerable vs. Patched Code

Vulnerable Code (<= 8.7.2):

add_action('wp_ajax_wpb_save_element', 'wpb_save_element_callback');
function wpb_save_element_callback() {
    $post_id = intval($_POST['post_id']);
    $element_data = $_POST['element_data'];
    update_post_meta($post_id, '_wpb_element_data', $element_data);
    wp_die();
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_wpb_save_element', 'wpb_save_element_callback');
function wpb_save_element_callback() {
    if (!current_user_can('edit_post', intval($_POST['post_id']))) {
        wp_die('Unauthorized', 403);
    }
    $post_id = intval($_POST['post_id']);
    $element_data = $_POST['element_data'];
    update_post_meta($post_id, '_wpb_element_data', $element_data);
    wp_die();
}

The fix adds a capability check using current_user_can('edit_post', $post_id) before performing any sensitive operations.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WPBakery Page Builder <= 8.7.2
• A valid Subscriber account (username/password)

Steps:

1. Log in as a Subscriber and obtain a nonce for AJAX actions (if required).
2. Craft a POST request to wp-admin/admin-ajax.php with action wpb_save_element:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_xxx=...

action=wpb_save_element&post_id=1&element_data={"type":"text","content":"<script>alert('XSS')</script>"}

3. The plugin will save the malicious element data to the post's meta, which will be rendered when an admin views the page.

Note: No public exploit code is available; this is a theoretical exploitation path.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action parameters like wpb_save_element, wpb_get_element_backend_editor from low-privilege users.
• Look for unusual element_data payloads containing JavaScript or unexpected HTML.

Hardening:

• Disable the WPBakery plugin until a patch is released.
• Restrict Subscriber accounts to trusted users only.
• Use a Web Application Firewall (WAF) to block suspicious AJAX requests.
• Implement custom capability checks via a WordPress mu-plugin.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/js_composer/include/classes/core/class-vc-shared-library.php (modified or containing suspicious code)
• Database: wp_postmeta entries with _wpb_element_data containing <script> tags or base64-encoded payloads.
• Logs: Repeated admin-ajax.php requests from Subscriber IPs with wpb_ action parameters.
• Network: Outbound connections to known malicious domains from the WordPress admin dashboard.

Detection Engineering

YARA Rule

rule wpbakery_broken_access_control {
    meta:
        description = "Detects WPBakery Page Builder vulnerable to CVE-2026-45436"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-45436"
    strings:
        $ajax_action = "wpb_save_element" nocase
        $ajax_action2 = "wpb_get_element_backend_editor" nocase
        $cap_check = "current_user_can" nocase
    condition:
        ($ajax_action or $ajax_action2) and not $cap_check
}

Sigma Rule

title: WPBakery Broken Access Control Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects AJAX requests from low-privilege users to WPBakery endpoints
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query:
            - '*action=wpb_save_element*'
            - '*action=wpb_get_element_backend_editor*'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-45436 - WPBakery Broken Access Control Exploitation";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=wpb_save_element"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPBakery Page Builder plugin until an official patch is released.
2. Review and remove any untrusted Subscriber accounts from the WordPress site.
3. Audit wp_postmeta for suspicious _wpb_element_data entries and delete them.

Long-term Fix:

• Apply the vendor's patch when available (check https://wpbakery.com/).
• Implement a custom WordPress mu-plugin that adds capability checks to all WPBakery AJAX endpoints.
• Consider migrating to an alternative page builder with active security support.

Workaround:

• Use a WAF rule to block AJAX requests containing wpb_save_element or wpb_get_element_backend_editor from non-admin users.

Valters IT
Securing WordPress Ecosystems | DevSecOps & Threat Intelligence