CVE-2026-5093 wpsoul CVE debrief

Who should care

WordPress site administrators and security teams should assess exposure and apply patches or mitigations to prevent unauthorized modification of global theme color settings. This vulnerability allows authenticated attackers with contributor-level access and above to modify global WordPress theme color settings site-wide, leading to site defacement. Affected operators and platforms should prioritize patching and vulnerability management. Security teams need

Why it matters

CVE-2026-5093 allows authenticated attackers with contributor-level access to modify global WordPress theme color settings site-wide, leading to site defacement. WordPress site administrators and security teams should assess exposure and apply patches or mitigations.

• Site defacement through unauthorized theme color settings modifications.
• Potential for attackers to make unauthorized changes to the site's appearance.
• Need for verification of the 'gspb_update_global_wp_settings' function's capability check.
• Priority for WordPress site administrators to restrict access to plugin settings.

Technical summary

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_settings' function that only verifies the 'edit_posts' capability instead of requiring administrative privileges. The vulnerability allows authenticated attackers with contributor-level access and above to modify global WordPress theme color settings site-wide, leading to site defacement. WordPress site administrators and security teams should assess exposure and apply patches or mitigations to prevent unauthorized modification of global theme color settings.

Defensive priority

Medium priority for WordPress site administrators and security teams to assess exposure and apply patches or mitigations.

Recommended defensive actions

• Assess exposure by checking if the GreenShift – Animation and Page Builder Blocks plugin is installed and if the version is up to date.
• Verify that the 'gspb_update_global_wp_settings' function has a proper capability check in place.
• Restrict access to the plugin's settings to only administrative users.
• Monitor for suspicious activity related to theme color settings modifications.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is due to a missing capability check on the 'gspb_update_global_wp_settings' function, which only verifies the 'edit_posts' capability instead of requiring administrative privileges.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.