WordPress Greenshift Missing Authorization Vulnerability Allowing Global Settings Modification (CVE-2026-5093)

Vulnerability Overview Vulnerability Name: Greenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings' CVE ID: CVE-2026-5093 CVSS Score: 4.3 (Medium) Publication Date: August 21, 2026 Last Update Date: August 22, 2026 Researcher: Rahan Adi Arba Impact Scope Affected Versions: <= 12.8.9 Vulnerability Type: Missing Authorization Description: The Greenshift – Animation and Page Builder Blocks plugin for WordPress, up to and including version 12.8.9, contains a vulnerability that allows unauthorized modification of data. This is due to a lack of 'edit_posts' capability check in the 'gspb_update_global_wp_settings' function, instead of requiring administrator privileges. This enables authenticated attackers with Contributor level or higher privileges to modify global WordPress theme color settings, resulting in website tampering. Remediation Fixed Version: 12.9.0 or later Recommendation: Update to version 12.9.0 or a later patched version. Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Recent Vulnerabilities List Recent vulnerabilities in Greenshift – animation and page builder blocks include: - CVE-2026-4895: Stored Cross-Site Scripting via disableability Attribute - CVE-2026-2371: Missing Authorization to Unauthenticated Private Reusable Block Disclosure via 'gspb_el_reusable_load' - CVE-2026-2589: Unauthenticated Sensitive Information Exposure via Settings Backup - CVE-2026-2593: Authenticated (Contributor+) Stored Cross-Site Scripting - CVE-2026-1927: Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css - CVE-2025-11841: Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Data Attributes - CVE-2025-57884: Missing Authorization - CVE-2025-49301: Authenticated (Contributor+) Stored Cross-Site Scripting - CVE-2025-3616: Authenticated (Subscriber+) Arbitrary File Upload - CVE-2025-30873: Authenticated (Contributor+) Stored Cross-Site Scripting Summary This vulnerability involves the Greenshift plugin in versions up to and including 12.8.9, where insufficient permission checks lead to unauthorized data modification. Users are advised to update to version 12.9.0 or later as soon as possible to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Greenshift Missing Authorization Vulnerability Allowing Global Settings Modification (CVE-2026-5093)

More from this source