Description

The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_settings' function that only verifies the 'edit_posts' capability instead of requiring administrative privileges. This makes it possible for authenticated attackers, with contributor-level access and above, to modify global WordPress theme color settings site-wide, leading to site defacement.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-22T14:16:33.210Z",
  "pubdate": "2026-08-22T14:16:33.210Z",
  "executiveSummary": "The GreenShift – Animation and Page Builder Blocks plugin for WordPress is susceptible to an authorization bypass vulnerability, specifically resulting from an insufficient capability check within the administrative interface. The flaw resides in the handling of global site configurations, enabling lower-privileged users to alter sensitive theme properties.\nSpecifically, versions up to, and including, 12.8.9 fail to properly restrict access to the gspb_update_global_wp_settings function. Instead of enforcing strict administrative access controls, the function merely verifies the edit_posts capability, which is standard for authenticated users with contributor-level privileges.\nConsequently, an authenticated attacker possessing contributor-level access or higher can exploit this design flaw to execute unauthorized modifications of data. By leveraging this authorization oversight, malicious actors can systematically alter global WordPress theme color settings across the entire target installation.\nThe primary risk implication of this vulnerability is persistent site defacement and unauthorized tampering with visual presentation layers. Although exploitation requires prior authentication, the low privilege threshold significantly expands the attack surface, allowing untrusted users to manipulate global application settings that should be strictly reserved for high-privileged administrators.",
  "technicalDetails": "The vulnerability is rooted in an inadequate access control implementation within the GreenShift – Animation and Page Builder Blocks plugin. The vulnerable component is the gspb_update_global_wp_settings function, which is exposed to handle AJAX or REST API requests related to global site configurations and theme styling parameters.\nThe root cause of the security defect is the reliance on a weak capability check. Rather than validating that the incoming request originates from a user possessing administrative privileges (such as manage_options), the function incorrectly evaluates the request against the edit_posts capability. In the WordPress user role taxonomy, the edit_posts capability is universally granted to users assigned to the contributor role and above.\nBecause network exposure is inherent to WordPress AJAX and endpoint handling mechanisms, any authenticated user with contributor privileges can interact with the affected handler. To exploit this vulnerability, an attacker crafts an HTTP request targeting the appropriate backend routing mechanism, invoking the gspb_update_global_wp_settings function with modified parameters representing the desired global theme color configurations.\nThe attack flow proceeds as follows: First, the attacker authenticates to the WordPress site with a contributor-level account. Second, the attacker formulates an HTTP request designed to trigger the gspb_update_global_wp_settings function, injecting arbitrary values into the payload parameters that dictate global WordPress theme color settings. Third, the backend application processes the request, evaluating the user's permissions via the flawed capability check. Because the contributor possesses the edit_posts capability, the authorization check passes successfully.\nUpon validation, the application executes the logic within gspb_update_global_wp_settings, overwriting the existing global theme configuration data stored in the database with the attacker-supplied payload. The post-exploitation impact is immediate and site-wide, as the altered color settings are rendered dynamically across all pages and posts served by the WordPress instance, culminating in unauthorized data modification and site defacement."
}