CVE-2026-75927 PUBLISHED

PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

Assigner: Wordfence
Reserved: 18.08.2026 Published: 09.09.2026 Updated: 09.09.2026

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities() function unconditionally granting the Editor role all 15 manage_capabilities_* capabilities — including manage_capabilities, manage_capabilities_roles, manage_capabilities_settings, and manage_capabilities_backup — via a hard-coded $eligible_roles = ['administrator', 'editor'] assignment that runs automatically on the first admin_init after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with cme_, capsman, pp_capabilities, or presspermit via update_option(). The escalation stops short of full Administrator access, as WordPress's map_meta_cap layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on manage_capabilities_* capabilities remains fully accessible.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.2

Product Status

Vendor publishpress
Product User Role Editor – PublishPress Capabilities: Access Control and User Roles
Versions Default: unaffected
  • affected from 0 to 2.50.0 (incl.)

Credits

  • Wordfence PRISM finder

References

Problem Types

  • CWE-269 Improper Privilege Management CWE