CVE-2026-4261 - Vulnerability Analysis

Overview

WordPress Expire Users plugin <= 1.2.2 contains a privilege escalation caused by improper update of 'on_expire_default_to_role' meta in 'save_extra_user_profile_fields', letting authenticated users elevate privileges to administrator, exploit requires Subscriber-level access or higher.

Severity & Score

Impact

Authenticated users can escalate their privileges to administrator, compromising site control.

Mitigation

Update to a version later than 1.2.2 or the latest available version.

References

• https://plugins.trac.wordpress.org/browser/expire-users/tags/1.2.2/admin/expire-user.php#L163
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d676700b-8c53-4e09-a654-767810b5a775?source=cve

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner