CVE-2026-4261 - Vulnerability Analysis
HighCVSS: 8.8Last Updated: March 23, 2026
WordPress Expire Users - Privilege Escalation
Overview
WordPress Expire Users plugin <= 1.2.2 contains a privilege escalation caused by improper update of 'on_expire_default_to_role' meta in 'save_extra_user_profile_fields', letting authenticated users elevate privileges to administrator, exploit requires Subscriber-level access or higher.
Severity & Score
Impact
Authenticated users can escalate their privileges to administrator, compromising site control.
Mitigation
Update to a version later than 1.2.2 or the latest available version.
References
Social Media Activity(2 posts)
š CVE-2026-4261 - High (8.8) The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a user to update the 'on_expire_default_to_role' meta through the 'save_extra_user_profile_... š https://www.thehackerwire.com/vulnerability/CVE-2026-4261/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack
View original post
š„ HIGH severity: CVE-2026-4261 in Expire Users (WordPress, all versions) lets Subscribers escalate to Admin via missing authorization in 'save_extra_user_profile_fields'. Patch urgently or mitigate! https://radar.offseq.com/threat/cve-2026-4261-cwe-862-missing-authorization-in-hus-fa4ebb4d #OffSeq #WordPress #Vuln #Security
View original postRelated Resources
Details
- CVE ID
- CVE-2026-4261
- Severity
- High
- CVSS Score
- 8.8
- Type
- broken_access_control
- Status
- unconfirmed
- EPSS
- 3.9%
- Social Posts
- 2
CWE
- CWE-862
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H