CVE-2026-48197: Incorrect Privilege Assignment in PublishPress PublishPress Capabilities

This vulnerability in PublishPress Capabilities (up to version 2.45.0 and likely up to but not including 2.50.0) is due to incorrect privilege assignment in the capability-manager-enhanced component. It enables an attacker with some level of privileges to escalate their privileges further, potentially gaining full control over the system. The CVSS 3.1 score is 7.2, indicating a high severity with network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows privilege escalation, which can lead to complete compromise of the affected system's confidentiality, integrity, and availability. This could enable attackers to perform unauthorized actions with elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor PublishPress advisories for updates and apply patches once available.