CVE-2026-77003 is a privilege management vulnerability in the Content Mask WordPress plugin. Versions prior to 1.8.5.5 do not properly check user capabilities when publishing post types, enabling users with a Contributor role—who normally cannot publish content—to publish posts and pages. This flaw violates the principle of least privilege by allowing lower-privileged users to perform actions reserved for higher-privileged roles.

Users with the Contributor role can publish posts and pages without the appropriate publish permissions. This could lead to unauthorized content appearing on the website, potentially impacting content integrity and site trustworthiness. There is no indication of further privilege escalation or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor role permissions or disable the Content Mask plugin if possible to prevent unauthorized publishing.