Loading vulnerability…
Privilege Escalation in WordPress Expire Users plugin
CVE-2026-4261 is a privilege escalation vulnerability in the Expire Users plugin for WordPress affecting all versions up to and including 1.2.2. The flaw is caused by insufficient authorization in the plugin's save_extra_user_profile_fields function, which allows a user to update the on_expire_default_to_role meta value. Because this role-related metadata can be modified by a low-privileged authenticated user, an attacker can abuse the plugin's expiration-role handling to assign a more privileged role. As described in the provided content, authenticated attackers with Subscriber-level access or higher can leverage this weakness to escalate their privileges to administrator.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation allows an authenticated low-privileged user to obtain administrator-level access in the affected WordPress site. This can lead to full compromise of the WordPress application, including access to sensitive data, modification of site content and configuration, installation or modification of plugins and themes, creation of additional privileged accounts, and potential further code execution depending on site configuration and available administrative capabilities.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the Expire Users plugin or restrict access to affected WordPress instances to trusted users only. Reduce exposure by limiting or removing low-privileged accounts such as Subscribers where feasible, and monitor for changes to user roles, profile metadata, and creation of new administrator accounts. Additional compensating controls include enforcing strong authentication, reviewing plugin code customizations, and using WordPress security monitoring to detect suspicious profile updates or privilege changes.
Patch, then assume compromise.
Update the Expire Users plugin to a version newer than 1.2.2 once a vendor fix is available. If no patched version is available, remove or disable the plugin to eliminate exposure. Review the plugin's handling of save_extra_user_profile_fields and ensure only appropriately authorized administrators can modify the on_expire_default_to_role meta or any role-affecting user metadata. After remediation, audit user accounts and role assignments for unauthorized administrator creation or privilege changes.
No public exploits tracked yet. Mallory keeps watching.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.