Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-75927— PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

Quick assessment

Affected
publishpress User Role Editor – PublishPress Capabilities: Access Control and User Roles
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 插件 PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus 在所有版本中（直至并包括 2.50.0）存在权限提升漏洞。 该漏洞的成因在于 函数无条件地为 Editor（编辑者） 角色授予了全部 15 种 权限，其中包括 、 、 和 。这一行为是通过硬编码的 赋值实现的，并在插件激活后的首次 钩子中自动执行，无需管理员显式开启，且这些权限授予会直接持久化到数据

CVSS 7.2 · High

Possible ATT&CK Techniques 1 AI

T1090 · Proxy
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75927

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
Source: CVE Program / CVE List V5
Vulnerability Description
The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligible_roles = ['administrator', 'editor']` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress's `map_meta_cap` layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on `manage_capabilities_*` capabilities remains fully accessible.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
特权管理不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
publishpress User Role Editor – PublishPress Capabilities: Access Control and User Roles 0 ~ 2.50.0 -

II. Public POCs for CVE-2026-75927

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75927

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-75927 (3)

Vendor Pages for CVE-2026-75927 (1)

IV. Related Vulnerabilities

Same vendor: publishpress
Same weakness: CWE-269

V. Comments for CVE-2026-75927

No comments yet

Leave a comment