The PublishPress Capabilities – User Role Editor plugin for WordPress versions up to and including 2.50.0 has a privilege escalation vulnerability (CWE-269) due to the addPluginCapabilities() function unconditionally granting the Editor role all 15 manage_capabilities_* capabilities. This occurs automatically on the first admin_init after plugin activation without administrator opt-in, persisting these elevated permissions in the database. As a result, authenticated users with Editor-level access can escalate privileges to manage roles (create, rename, delete non-system roles), modify capabilities of non-administrator roles, restore role backups, and update arbitrary plugin options prefixed with cme_, capsman, pp_capabilities, or presspermit. Full Administrator privileges are not granted because WordPress's map_meta_cap layer restricts administrator-only capabilities. However, all functionality gated on manage_capabilities_* remains accessible to the escalated Editor role.

Authenticated users with Editor-level privileges can escalate their permissions to effectively manage user roles and plugin settings across the WordPress site. This includes creating, renaming, and deleting roles (except system roles), modifying capabilities of non-administrator roles, restoring role backups, and altering plugin options. This can lead to significant unauthorized control over site access and configuration, potentially compromising site integrity and security. Full Administrator privileges are not granted, limiting some high-level capabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting Editor-level access or disabling the plugin if possible. Monitor for vendor updates or patches addressing this privilege escalation vulnerability.