CVE-2025-14866 is an incorrect authorization vulnerability (CWE-863) in the Melapress Role Editor plugin for WordPress. The issue is due to a misconfigured capability check in the 'save_secondary_roles_field' function, which enables authenticated users with low-level privileges (Subscriber and above) to escalate their privileges by assigning themselves higher roles such as Administrator. This vulnerability affects all versions up to and including 1.1.1. The CVSS 3.1 base score is 8.8, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. No patch or official fix has been published yet.

Successful exploitation allows an authenticated attacker with Subscriber-level access or higher to escalate privileges to Administrator. This can lead to full control over the affected WordPress site, including the ability to modify content, install plugins, change configurations, and potentially compromise the entire site and its data. The vulnerability impacts confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to trusted users only and consider disabling or removing the Melapress Role Editor plugin if possible. Monitor for updates from the vendor or security community regarding patches or temporary mitigations.