WordPress Content Mask Privilege Escalation via create_new_content_mask (CVE-2026-77003)

Vulnerability Overview Vulnerability Name: Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask Description: The plugin fails to check the required permissions for publishing newly created post types, allowing users with the Contributor role to publish posts and pages without the necessary publish capabilities. CVE Number: CVE-2026-77003 Classification: - Type: PRIVESC - OWASP Top 10: A2: Broken Authentication and Session Management - CWE: CWE-269 - CVSS: 2.7 (low) Affected Versions Affected Plugin: content-mask Fixed Version: 1.8.5.5 Remediation Fixed Version: Upgrade to version 1.8.5.5 or higher. Timeline Public Disclosure Date: 2026-08-21 Added Date: 2026-08-21 Last Updated Date: 2026-08-21 Additional Information Original Researchers: Pablo González and Fran Ramírez Submitter: Pablo González and Fran Ramírez Verification Status: Yes WPVDB ID: 1a78993c-1e5c-43fb-9aa4-13edc24100ee References CVE: CVE-2026-77003 Related Vulnerabilities Funnel Builder by CartFlows < 1.3.1 - Authenticated Arbitrary Plugin Activation Vikinger < 1.9.31 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax' WordPress RealHomes Theme < 4.3.7 - Privilege Escalation Frisbil Pay < 1.8.2.1 - Contributor+ Privilege Escalation WPGuppy < 1.1.1 - Subscriber+ Privilege Escalation Proof of Concept (PoC) PoC Code: The page states that the PoC will be revealed on 2026-09-04 to give users time to update. Specific code is not provided. --- The above is a summary of the key information regarding the vulnerability from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Content Mask Privilege Escalation via create_new_content_mask (CVE-2026-77003)

More from this source