WordPress security changelog
HIGH CVE-2026-75927 Deferred

PublishPress Capabilities automatically grants Editors role-management privileges

PublishPress Capabilities through 2.50.0 runs addPluginCapabilities() on the first admin_init after activation and persists all 15 manage_capabilities_* grants to Editors without administrator opt-in. An Editor can then manage non-system roles, modify non-administrator role capabilities, restore role backups, and write plugin options with the cme_, capsman, pp_capabilities, or presspermit prefixes. This does not grant full Administrator status: WordPress map_meta_cap still prevents granting administrator-only capabilities.

CVE / CNA score 7.2 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
User Role Editor – PublishPress Capabilities: Access Control and User Roles
Plugin slug
capability-manager-enhanced
Affected
<= 2.50.0
Safe version
2.50.1
Published
Sep 09, 2026
Weakness
CWE-269 — Improper Privilege Management

This CVE was published Sep 09, 2026 and is one of 5 known issues for this plugin.

What to do

Update, patch or deactivate.

Update PublishPress Capabilities to 2.50.1 or later. The official changelog identifies the matching fix. Review previously persisted Editor capability grants and unauthorized role or plugin-setting changes.

A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligible_roles = ['administrator', 'editor']` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress's `map_meta_cap` layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on `manage_capabilities_*` capabilities remains fully accessible.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources