What is the CVSS score of CVE-2026-9842?

CVE-2026-9842 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Backstage Plugin are affected by CVE-2026-9842?

The Pixelgrade Backstage - Customizer Demo Access WordPress plugin (versions through 1.4.2) contains a privilege escalation vulnerability allowing unauthenticated attackers to modify critical site…

How to fix or mitigate CVE-2026-9842?

Within 24 hours: Audit all WordPress installations for the Pixelgrade Backstage - Customizer Demo Access plugin (versions ≤1.4.2) and disable or remove it immediately; if temporary retention is necessary, restrict access to admin pages via WAF rules. Within 7 days: Evaluate alternative customization solutions and apply any available security updates to WordPress core and plugins; review WordPress user roles and audit logs for unauthorized admin account creation or unauthorized option changes. Within 30 days: Complete migration to alternative tools and conduct comprehensive WordPress database audit for unauthorized configuration changes; monitor vendor advisory channels for patch release; implement version pinning to prevent re-installation of vulnerable versions.

Backstage Plugin CVE-2026-9842

EUVD-2026-42160 HIGH

Improper Privilege Management (CWE-269)

2026-07-08 Wordfence

GHSA-xwxr-p855-gjc3

WordPress Privilege Escalation Wordpress Plugin Backstage Customizer Demo Access Pixelgrade

7.5

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network access to the demo flow (PR:N/AV:N/AC:L) allows arbitrary option writes; direct impact is integrity-only (I:H), with no direct confidentiality or availability loss.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 05:20 vuln.today

CVE Published

Jul 08, 2026 - 04:30 cve.org

HIGH 7.5

DescriptionCVE.org

The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the manage_options capability to the backstage_customizer_user demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as default_role, leading to privilege escalation.

AnalysisAI

Privilege escalation in the Pixelgrade Backstage - Customizer Demo Access plugin for WordPress (all versions through 1.4.2) lets unauthenticated attackers modify arbitrary site options. The plugin grants the overly broad manage_options capability to its backstage_customizer_user demo role, so an attacker reaching the demo flow can change settings such as default_role and escalate to a privileged account. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin (cpe:2.3:a:pixelgrade:backstage_-_customizer_demo_access) that provisions a temporary demo user so visitors can preview the WordPress Theme Customizer. WordPress capabilities are the primitive that gate administrative actions; manage_options is the capability that governs the site-wide options API (the wp_options table and Settings screens). The root cause maps to CWE-269 (Improper Privilege Management): the plugin assigns manage_options - far broader than Customizer-only preview requires - to the demo role. Because manage_options authorizes writing any option, the demo identity can reach options.php/option-update paths well beyond the Customizer, including security-sensitive keys like default_role (the role assigned to new registrations) and users_can_register. The referenced source lines (class-Backstage.php L154 and L348 in tag 1.4.2) correspond to where the demo role/capability is defined and applied.

RemediationAI

No vendor-released patch version is identified in the available data, so no fixed release can be cited with confidence - monitor the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/5bcf1f02-0946-4e96-a81b-00c7c48d64b3) and the plugin's WordPress.org page for a release above 1.4.2 and upgrade as soon as one is published. Until then, the most direct compensating control is to deactivate and remove the Backstage plugin, which fully removes the over-privileged demo role at the cost of losing Customizer demo functionality. If demo access must remain, restrict reachability by disabling or firewalling the demo login/preview endpoints and placing the site behind authentication or an allowlist so untrusted users cannot initiate a demo session. As a defense for the specific escalation path, harden the registration setting by keeping users_can_register disabled and pinning default_role to subscriber, and audit wp_options (especially default_role and users_can_register) plus the user list for unexpected changes - noting these are detective/limiting controls, not a fix for the underlying capability misassignment.