PublishPress Capabilities CVE-2026-75927

Exploitation requires: (1) PublishPress Capabilities plugin version ≤2.50.0 installed and activated on the target WordPress site - activation must have occurred at least once so that addPluginCapabilities() has run on admin_init and persisted the Editor capability grants to the database; (2) attacker must hold valid WordPress Editor-level credentials (PR:H). The escalation is bounded: WordPress's map_meta_cap layer blocks the escalated Editor from granting or acquiring administrator-only capabilities, so full site compromise (adding new Administrator accounts via standard user management) is not directly achievable through this flaw alone. The persistence of the database grants means the vulnerability remains exploitable even if the plugin is deactivated after initial activation.

The provided CVSS 7.2 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) accurately reflects the attack profile: network-accessible via the WordPress admin panel, no interaction or complexity beyond possessing an Editor account, and high impact across all three pillars due to the scope of role and option manipulation possible. PR:H correctly captures that Editor is a trusted, privileged WordPress role - not an anonymous user. The S:U designation is defensible since escalation remains within the WordPress installation boundary. Real-world risk hinges on whether attacker-controlled Editor accounts exist: in multi-author WordPress environments (media, publishing, agencies) Editor accounts are common and may be shared or compromised. The persistence mechanism - grants written to the database on plugin activation - means the attack surface opens silently at install time with no further administrator action required. No KEV listing and no confirmed public exploit code mean opportunistic mass exploitation is not currently confirmed, but the flaw is straightforward to exploit once discovered, making it a meaningful priority for sites running affected versions with Editor-level users outside the trust boundary.

An attacker who has obtained WordPress Editor credentials - through phishing, credential stuffing, or a separate vulnerability - logs into the admin panel of a site running PublishPress Capabilities ≤2.50.0. Because plugin activation has already silently written all manage_capabilities_* grants to the Editor role in the database, the attacker can immediately navigate to the plugin's role management interface and begin modifying other roles' capabilities, creating privileged custom roles, or manipulating plugin options to alter site behavior, effectively gaining role-management authority over the entire WordPress installation. No exploit tooling is confirmed publicly, but the attack path requires only knowledge of the plugin's admin interface.