What is the CVSS score of EUVD-2026-53953?

EUVD-2026-53953 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Which versions of PublishPress Capabilities are affected by EUVD-2026-53953?

The PublishPress Capabilities WordPress plugin (versions ≤2.45.0) enables authenticated Editor-level users to escalate privileges and gain unauthorized elevated capabilities through a capability…

How to fix or mitigate EUVD-2026-53953?

Within 24 hours: inventory all WordPress installations running PublishPress Capabilities version 2.45.0 or earlier and document all users assigned Editor-level roles. Within 7 days: restrict Editor role assignments to only essential, trusted personnel; disable unnecessary capabilities (publish_posts, manage_categories, edit_others_posts) for Editor accounts via WordPress native role management or plugin settings; and implement activity logging for Editor-level account actions. Within 30 days: conduct a comprehensive audit of role assignments across all WordPress instances, establish a quarterly access review process with documented justification for each Editor account, require multi-factor authentication for all Editor users, and develop an upgrade plan to deploy the patch immediately upon vendor release.

PublishPress Capabilities EUVD-2026-53953

| CVE-2026-28183 HIGH

Incorrect Privilege Assignment (CWE-266)

2026-08-06 Patchstack

GHSA-m34w-rg3p-g738

WordPress Privilege Escalation Publishpress Capabilities Wordpress Plugin Publishpress

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Editor role access (PR:H) is required; exploitation occurs over the network via the WordPress admin interface with no interaction needed and full-system impact upon successful escalation.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:23 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.2

DescriptionCVE.org

Editor Privilege Escalation in PublishPress Capabilities <= 2.45.0 versions.

AnalysisAI

Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

PublishPress Capabilities (formerly capability-manager-enhanced) is a WordPress plugin that extends and manages the role-capability matrix built into WordPress core. WordPress enforces a hierarchical role model (Subscriber < Contributor < Author < Editor < Administrator), and plugins like PublishPress Capabilities expose a UI and programmatic interface to assign or modify these capabilities at a granular level. The affected versions (all releases up to and including 2.45.0, per CPE cpe:2.3:a:publishpress:publishpress_capabilities:*:*:*:*:*:*:*:*) contain a CWE-266 (Incorrect Privilege Assignment) flaw, meaning the plugin fails to properly enforce boundaries when an Editor-role user interacts with its capability assignment functions - allowing that user to assign themselves or others capabilities that exceed the Editor tier, up to and including Administrator-level access.

RemediationAI

Upgrade PublishPress Capabilities to a version above 2.45.0 immediately; the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/capability-manager-enhanced/vulnerability/wordpress-publishpress-capabilities-plugin-2-45-0-privilege-escalation-vulnerability should be consulted to confirm the exact patched release, as no specific fix version number was provided in the available intelligence. As a compensating control pending upgrade, administrators should audit all Editor-role accounts and remove or demote any assigned to untrusted users, since exploitation requires an active Editor session. Additionally, review the PublishPress Capabilities settings panel for any suspicious capability assignments that may have already been made, and temporarily restrict access to the plugin's settings pages to Administrator accounts only via server-level controls (e.g., blocking the relevant admin-ajax or REST endpoints used by the plugin). Deactivating the plugin entirely is an option for sites that do not actively rely on its granular role management, with the trade-off that custom capability assignments managed by the plugin may revert to WordPress defaults.