Content Mask CVE-2026-77003

Exploitation requires an authenticated session with at minimum a Contributor role on the target WordPress site. The Content Mask plugin (version 1.8.0-1.8.5.4) must be installed and active. Sites that disable open user registration and restrict Contributor accounts to known, trusted users are not exposed to external attackers. The CVSS vector confirms no user interaction is required once the attacker holds an account, and no special network position is needed. Exploitation is limited in impact to unauthorized content publication - there is no code execution path, no confidentiality impact, and no availability impact.

The vendor-assigned CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N yields a score of 2.7 (Low). However, the PR:H rating appears inconsistent with the description, which states exploitation requires only a Contributor role - a low-privilege authenticated user in WordPress terms, which maps more accurately to PR:L in CVSS. An independent assessment using PR:L yields approximately 3.7 (Low-Medium), still a low-severity finding. Either way, the real-world risk is constrained: no confidentiality or availability impact exists, scope is unchanged, and the worst outcome is unauthorized content publication rather than code execution or data theft. EPSS at 0.18% (8th percentile) and absence from CISA KEV confirm the security community observes no meaningful exploitation activity. Sites restricting user registration or limiting Contributor accounts to trusted individuals face no practical external threat.

An attacker who holds or registers a Contributor account on a target WordPress site with the Content Mask plugin installed navigates to the plugin's custom post type interface and submits a publish request. Because the plugin omits the capability check, WordPress accepts and publishes the content, bypassing the editorial review queue that Contributors are otherwise subject to.