Publishpress Capabilities
Monthly
Privilege escalation in the PublishPress Capabilities WordPress plugin (slug capability-manager-enhanced) up to and including version 2.45.0 lets an attacker who already holds an elevated authenticated role use the plugin's role/capability management functions to grant themselves capabilities they should not receive, potentially reaching full site compromise (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The dominant risk-limiting factor is the PR:H prerequisite: the actor must already possess a high-privilege role, so sites that reserve such roles for fully trusted administrators face substantially reduced real-world exposure. No public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited in the provided intelligence.
Cross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficiently privileged WordPress user into silently submitting role- and capability-modification requests, producing unauthorized permission changes with high integrity impact. The published CVSS 8.1 reflects PR:N/UI:R, but the independent assessment scores the same flaw as C:N/I:H/A:N, giving a materially lower effective severity: exploitation is not self-driven, it requires an authenticated administrative victim to interact with attacker-controlled content during an active session. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and the issue should be treated as moderate priority despite the headline score.
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.
PublishPress Capabilities versions up to 2.31.0 contain an authorization bypass that allows authenticated users to exploit misconfigured access controls and gain unauthorized information disclosure. An attacker with valid credentials could leverage this vulnerability to access sensitive data they are not permitted to view. No patch is currently available for this vulnerability.
Privilege escalation in the PublishPress Capabilities WordPress plugin (slug capability-manager-enhanced) up to and including version 2.45.0 lets an attacker who already holds an elevated authenticated role use the plugin's role/capability management functions to grant themselves capabilities they should not receive, potentially reaching full site compromise (CVSS 3.1 base 7.2 High, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). The dominant risk-limiting factor is the PR:H prerequisite: the actor must already possess a high-privilege role, so sites that reserve such roles for fully trusted administrators face substantially reduced real-world exposure. No public exploit code has been identified at time of analysis, and the flaw is not reported as actively exploited in the provided intelligence.
Cross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficiently privileged WordPress user into silently submitting role- and capability-modification requests, producing unauthorized permission changes with high integrity impact. The published CVSS 8.1 reflects PR:N/UI:R, but the independent assessment scores the same flaw as C:N/I:H/A:N, giving a materially lower effective severity: exploitation is not self-driven, it requires an authenticated administrative victim to interact with attacker-controlled content during an active session. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and the issue should be treated as moderate priority despite the headline score.
Editor-level privilege escalation in the PublishPress Capabilities WordPress plugin (versions ≤ 2.45.0) enables authenticated users holding an Editor role to exceed their intended permission boundary and gain unauthorized elevated capabilities. The root cause is incorrect privilege assignment (CWE-266) within the plugin's capability management logic, and with a CVSS base score of 7.2 (High) reflecting high impact across confidentiality, integrity, and availability, the flaw is most dangerous on multi-tenant or agency WordPress sites where Editor accounts are distributed to semi-trusted users. No public exploit code or CISA KEV listing has been identified at time of analysis.
PublishPress Capabilities versions up to 2.31.0 contain an authorization bypass that allows authenticated users to exploit misconfigured access controls and gain unauthorized information disclosure. An attacker with valid credentials could leverage this vulnerability to access sensitive data they are not permitted to view. No patch is currently available for this vulnerability.