CVE-2026-4261

CVE-2026-4261 is a high-severity privilege escalation vulnerability affecting all versions up to and including 1.2.2 of the Expire Users plugin for WordPress. This flaw allows authenticated users with Subscriber-level access or higher to manipulate specific plugin settings, enabling them to elevate their privileges to that of an administrator. Rated 8.8 HIGH on the CVSS scale, it presents a significant risk with a network attack vector and low attack complexity, potentially leading to high impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, nor are public exploit codes available in common repositories like Metasploit or ExploitDB, and community discussion remains minimal.