CVE-2026-9842 describes a privilege escalation vulnerability in the pixelgrade Backstage - Customizer Demo Access plugin for WordPress. The vulnerability arises because the plugin grants the 'manage_options' capability to the 'backstage_customizer_user' demo role, which is more permissive than necessary for demo access limited to the Customizer. This misconfiguration enables unauthenticated attackers to bypass intended restrictions and update arbitrary WordPress options, including 'default_role', leading to privilege escalation. The issue affects all versions up to and including 1.4.2. No official patch or remediation level has been provided by the vendor as of the published date.

An unauthenticated attacker can exploit this vulnerability to escalate privileges by modifying critical WordPress options such as 'default_role'. This can allow the attacker to gain higher privileges within the WordPress site, potentially compromising site integrity and security. The vulnerability does not impact confidentiality but has a high impact on integrity. Availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the plugin or disable it if possible. Monitor for updates from the vendor pixelgrade regarding a security patch addressing this privilege escalation issue.