PublishPress Capabilities
PublishPress Capabilities manages WordPress user roles and controls their capabilities and permissions.
PublishPress Capabilities (capability-manager-enhanced) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Oct 06, 2026; the highest published CVSS base score is 8.1.
capability-manager-enhancedCVE-2026-48197: PublishPress Capabilities: Privilege escalation
The supplied CVSS vector requires a high-privilege authenticated account; the minimum WordPress role is undisclosed. An attacker can cross a permission boundary and gain privileges beyond those intended for the caller. The role-changing operation, target privilege and endpoint are undisclosed. The supplied vector reports high confidentiality impact, high integrity impact, high availability impact. The vector requires no victim interaction. Affected versions: <= 2.45.0. The authoritative export identifies 2.50.0 as fixed for this CVE.
| Safe version |
|
||
|---|---|---|---|
| Oct 06, 2026 |
CVE-2026-48197
PublishPress Capabilities: Privilege escalation
The supplied CVSS vector requires a high-privilege authenticated account; the minimum WordPress role is undisclosed. An attacker can cross a permission boundary and gain privileges beyond those intended for the caller. The role-changing operation, target privilege and endpoint are undisclosed. The supplied vector reports high confidentiality impact, high integrity impact, high availability impact. The vector requires no victim interaction. Affected versions: <= 2.45.0. The authoritative export identifies 2.50.0 as fixed for this CVE.
|
2.50.0 |
CVE7.2
|
| Sep 23, 2026 |
CVE-2026-94487
PublishPress Capabilities: Cross Site Request Forgery (CSRF)
An unauthenticated attacker can induce a victim's browser to perform an unwanted action in the victim's authenticated context. The forged action, endpoint, parameter, victim role and resulting state change are unspecified; the unauthenticated attacker classification does not remove the need for victim interaction. Affected versions: n/a through 2.50.1. Confirmed fixed release: 2.51.0.
|
2.51.0 |
CVE8.1
|
| Sep 09, 2026 |
CVE-2026-75927
PublishPress Capabilities automatically grants Editors role-management privileges
PublishPress Capabilities through 2.50.0 runs addPluginCapabilities() on the first admin_init after activation and persists all 15 manage_capabilities_* grants to Editors without administrator opt-in. An Editor can then manage non-system roles, modify non-administrator role capabilities, restore role backups, and write plugin options with the cme_, capsman, pp_capabilities, or presspermit prefixes. This does not grant full Administrator status: WordPress map_meta_cap still prevents granting administrator-only capabilities.
|
2.50.1 |
CVE7.2
|
| Aug 06, 2026 |
CVE-2026-28183
PublishPress Capabilities permits high-privilege users to cross an escalation boundary
An authenticated high-privilege user can exploit incorrect privilege assignment in PublishPress Capabilities through 2.45.0. The current export no longer specifies Editor as the exact role, and the endpoint, input, privilege granted and affected operation are unspecified. The source identifies 2.50.0 as fixed.
|
2.50.0 |
CVE7.2
|
| Mar 13, 2026 |
CVE-2026-32394
PublishPress Capabilities: A security weakness
PublishPress Capabilities is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE4.3
|