CVE-2026-75927: CWE-269 Improper Privilege Management in publishpress User Role Editor – PublishPress Capabilities: Access Control and User Roles
Affects publishpress User Role Editor – PublishPress Capabilities: Access Control and User RolesSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.6% chance of exploitation in 30 days – higher than 49% of CVEs
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| publishpressUser Role Editor – PublishPress Capabilities: Access Control and User Roles | Affected
| Fixed in– |
AI-suggested
Until an official fix is available, administrators should consider restricting Editor-level access or disabling the plugin if possible. Monitor for vendor updates regarding a patch or official fix.
Description
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligible_roles = ['administrator', 'editor']` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress's `map_meta_cap` layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on `manage_capabilities_*` capabilities remains fully accessible.
Summary
CVE-2026-75927 is a privilege escalation vulnerability in the PublishPress Capabilities – User Role Editor WordPress plugin (versions up to 2.50.0). The issue arises from the addPluginCapabilities() function, which unconditionally assigns all 15 manage_capabilities_* permissions to the Editor role on the first admin_init after plugin activation. This assignment is hard-coded and persists in the database without administrator opt-in. As a result, authenticated users with Editor-level access can escalate privileges to gain site-wide capability management, including creating, renaming, and deleting non-system roles, modifying capabilities of non-administrator roles, restoring role backups, and updating certain plugin options. However, full Administrator capabilities remain restricted by WordPress's map_meta_cap layer.
Impact
Authenticated users with Editor-level access can escalate their privileges to gain extensive role and capability management permissions across the WordPress site. This enables them to manipulate user roles (except Administrator roles), modify plugin settings, and write arbitrary plugin options, potentially compromising site integrity and security. The vulnerability does not grant full Administrator access but allows control over critical access control configurations.
Weaknesses
References
- wordfence.com/threat-intel/vulnerabilities/id/2f35ab5c-f897-404b-92ea-71bf1c98e0c0?source=cve (opens in a new tab)
- plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/classes/pp-capabilities-installer.php (opens in a new tab)
- plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/includes/admin-load.php (opens in a new tab)
- plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/includes/functions-admin.php (opens in a new tab)
- plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/includes/settings-handler.php (opens in a new tab)
- plugins.trac.wordpress.org/browser/capability-manager-enhanced/tags/2.50.0/includes/manager.php (opens in a new tab)
- plugins.trac.wordpress.org/changeset?reponame=&old=3665572%40capability-manager-enhanced&new=3665572%40capability-manager-enhanced (opens in a new tab)
Community reviews
Crowdsource mitigation strategies, share intel context, and vote on the most helpful responses.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.