CVE-2026-45436

Summary dbcve.org

This is a broken access control vulnerability in WPBakery Page Builder where Subscriber-level users can bypass authorization checks to access administrative functionality they should not have. The plugin fails to properly validate user roles before allowing access to privileged operations, allowing low-privilege users to interact with protected features.

Mitigation

Upgrade WPBakery Page Builder to version 8.7.3 or later to obtain the security patch that properly enforces role-based access controls for Subscriber users.