PublishPress Capabilities CVE-2026-28183

Exploitation requires a valid WordPress account with Editor role (or higher, below Administrator) on a WordPress installation running PublishPress Capabilities plugin version 2.45.0 or earlier. The CVSS vector PR:H confirms that unauthenticated exploitation is not possible - an active authenticated session with elevated role access is mandatory. Sites where Editor accounts are exclusively granted to fully trusted internal staff face substantially reduced real-world risk compared to multi-tenant platforms, open-registration sites, or agencies managing client sites. The flaw is further scoped to installations where the PublishPress Capabilities plugin is installed and active; sites not using this plugin are not affected. No specific non-default configuration trigger is identified in available intelligence beyond the plugin being present and the attacker holding an Editor-level account.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.2. The network attack vector and low complexity reflect that exploitation is straightforward over the web once the attacker is authenticated; the high-privilege prerequisite (PR:H - Editor role in WordPress context) is the primary limiting factor. No EPSS score was included in the provided intelligence, preventing probabilistic exploitation forecasting. The absence of both a CISA KEV listing and publicly known exploit code further moderates urgency for most deployments. However, real-world risk escalates significantly on multi-tenant WordPress environments - agencies, hosting platforms, membership sites - where Editor accounts are provisioned to users who are not fully trusted administrators. On such installations the effective risk approaches the full CVSS impact rating. CVSS scope is unchanged (S:U), confining direct impact to the compromised WordPress installation, though a full privilege escalation to Administrator enables secondary impacts such as plugin installation or credential harvesting that extend beyond the initial scope.

An attacker who has obtained valid WordPress Editor credentials - through phishing, credential stuffing, or being a malicious insider - authenticates to the target site and navigates to the PublishPress Capabilities administration interface. The attacker exploits the incorrect privilege assignment flaw to elevate their own account to Administrator, then installs a malicious plugin or creates a backdoor admin account to maintain persistent access. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) indicates that manual exploitation through the plugin's own UI is straightforward for any attacker familiar with WordPress administration.