EUVD-2026-93061
GHSA-w6q9-4pw2-9rcj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as privileged WordPress user
-
DeliverySend crafted capability-management request
-
ExploitAbuse incorrect privilege assignment
-
ExecutionEscalate to administrator capabilities
-
ImpactGain full site control
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Privilege assignment review
|
| Exploitation Conditions | Exploitation requires an existing authenticated WordPress account with elevated privileges (CVSS PR:H) on a site running PublishPress Capabilities (capability-manager-enhanced) version up to and including 2.45.0; the attacker interacts with the plugin's role/capability management feature to assign themselves capabilities they should not receive. The key limiting factors are the need for a pre-existing high-privilege role (not an anonymous or low-privilege user) and the plugin being installed and actively managing roles; no user interaction by a victim is needed (UI:N) and no special non-default configuration is indicated in the description. Sites that only grant such roles to fully trusted administrators face substantially reduced real-world risk. |
| Impact | The input CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 7.2 High) describes a network-exploitable, low-complexity flaw that nonetheless requires high privileges (PR:H), which is the dominant risk-limiting factor: an attacker must already hold an elevated authenticated WordPress role before escalating. No EPSS score was supplied, the CVE is not listed in CISA KEV, and no public exploit is referenced, so there is no public exploit identified at time of analysis. No SSVC decision data was provided. The signals are internally consistent - a privilege-escalation (CWE-266 Incorrect Privilege Assignment) bug in an access-control plugin naturally requires some pre-existing privilege - so this is a genuine but conditional issue rather than a mass-exploitable critical: realistic priority is moderate, elevated for sites that grant semi-trusted users roles managed by this plugin, and lower for tightly administered single-admin sites. No conflicting signals were detected, but the absence of EPSS/KEV/POC data means exploitation likelihood cannot be quantified from the input. |
| Exploit ScenarioDerived | An authenticated WordPress user who already holds an elevated (but non-administrator) role, such as an editor or a custom role managed by PublishPress Capabilities, abuses the plugin's incorrect privilege assignment to grant themselves administrator-level capabilities. Given AV:N/AC:L, this requires only a crafted request to the plugin's capability-management functionality and no user interaction. No public exploit code was referenced for this CVE. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Privilege escalation in the PublishPress Capabilities WordPress plugin (slug capability-manager-enhanced) up to and including version 2.45.0 lets an attacker who already holds an elevated authenticated role use the plugin's role/capability management functions to grant themselves capabilities they should not receive, potentially reaching full site compromise (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The dominant risk-limiting factor is the PR:H prerequisite: the actor must already possess a high-privilege role, so sites that reserve such roles for fully trusted administrators face substantially reduced real-world exposure. No public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited in the provided intelligence.
RemediationAI
No vendor-released patch version is identified in the provided intelligence at time of analysis; consult and monitor the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/capability-manager-enhanced/vulnerability/wordpress-publishpress-capabilities-plugin-2-45-0-privilege-escalation-vulnerability) and the PublishPress plugin page for an updated release, and apply it as soon as one is published. In the interim, the most effective control is strict least privilege: audit every account and custom role that can access the capability-management interface or holds role-editing capabilities, and revoke that access from anyone who is not a fully trusted administrator, accepting that this may break legitimate delegated role-administration workflows. If the plugin is not essential, deactivating and removing it eliminates the attack path, with the trade-off that custom roles and capability customizations revert to stock WordPress behavior and any dependent access rules or workflows may break; if it must stay active, restrict access to the plugin's admin pages (for example via IP allowlisting, a security plugin's admin-page restrictions, or WAF rules targeting the role/capability update requests), recognizing that these protections can be bypassed if the vulnerable functionality is also reachable through admin-ajax.php or REST endpoints. Additionally, enable and review WordPress audit logging for unexpected role or capability changes and new administrator accounts, and ensure no non-administrator role is granted authority to modify roles, since a single already-elevated account is all the flaw requires.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is classified as CWE-266 (Incorrect Privilege Assignment), a flaw class in which a system assigns a privilege level to an actor without adequately validating that the assignment is authorized. In WordPress, authorization is expressed through roles, each of which maps to a set of capabilities checked by functions such as current_user_can(); PublishPress Capabilities exists specifically to create custom roles and to edit those capability mappings. The vulnerability sits in that capability-management workflow: the plugin permits an actor to assign capabilities beyond what their own privilege level should allow, so a user with an elevated role can elevate further rather than being constrained by capability checks. Because the affected CPE is cpe:2.3:a:publishpress:publishpress_capabilities:*:*:*:*:*:*:*:*, every release through the last affected version 2.45.0 is in scope, and the plugin must be installed, active, and actually managing roles for the flawed assignment path to be reachable. The CVSS vector confirms network reachability with low complexity and no user interaction, and the scope is unchanged, meaning the compromise stays within the WordPress site's security authority; exploitation requires no special non-default configuration according to the available description.
Know when Publishpress Capabilities gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Remote over WordPress HTTP (AV:N), simple request (AC:L), but attacker must already hold an elevated role to reach the capability feature (PR:H); escalation to admin yields full C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
Executive ViewAI
A privilege-escalation flaw in the PublishPress Capabilities plugin (capability-manager-enhanced, versions up to and including 2.45.0) allows an already high-privileged authenticated user to escalate to full control of affected WordPress sites. Because exploitation requires an attacker to first hold an elevated role, the practical exposure is concentrated on sites that grant administrator or equivalent access broadly - including to contractors, agencies, or junior staff - rather than those limiting such roles to a small trusted group. Leadership should care because a successful escalation yields complete site compromise, risking content integrity, customer data, and brand trust, and no vendor patch is currently available to close the gap.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict administrator and other elevated roles to fully trusted personnel, minimize the number of high-privilege accounts, audit and trim unnecessary capabilities, limit access to the plugin's role/capability management interface, deactivate or remove the plugin if not operationally required, and monitor for unexpected role or capability changes.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Publishpress Capabilities
View allCross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficient
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenti
PublishPress Capabilities versions up to 2.31.0 contain an authorization bypass that allows authenticated users to explo
Exploit-DB