CVE-2026-9842 is a privilege escalation vulnerability in the pixelgrade Backstage - Customizer Demo Access plugin for WordPress versions up to and including 1.4.2. The issue arises because the plugin assigns the 'manage_options' capability to the 'backstage_customizer_user' demo role, which is more permissive than necessary for demo access limited to the Customizer. This misconfiguration allows unauthenticated attackers to bypass intended restrictions and update arbitrary WordPress options, including sensitive settings like 'default_role', resulting in privilege escalation.

An unauthenticated attacker can exploit this vulnerability to escalate privileges by modifying critical WordPress options. This can lead to unauthorized administrative control or other high-impact changes within the WordPress environment. The vulnerability does not affect confidentiality but has a high impact on integrity, allowing attackers to alter site configuration without authorization.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or disable the Backstage - Customizer Demo Access plugin if possible, and monitor for updates from the vendor. Avoid assigning excessive capabilities to demo roles and review user role permissions carefully.