Privilege Escalation in PublishPress Capabilities Plugin

The PublishPress Capabilities plugin for WordPress, specifically in versions 2.50.0 and earlier, is vulnerable to an unauthorized privilege escalation flaw. The issue resides within the 'addPluginCapabilities()' function, which executes automatically during the 'admin_init' hook upon plugin activation. This function unilaterally grants the WordPress 'Editor' role fifteen distinct 'manage_capabilities_*' capabilities, such as 'manage_capabilities', 'manage_capabilities_roles', and 'manage_capabilities_settings', without requiring administrator verification or opt-in.

Because these capability assignments are persisted directly into the site's database, an authenticated user already holding the 'Editor' role can gain control over role management and plugin configuration settings. While this does not bypass WordPress's internal 'map_meta_cap' logic to provide full administrative control, it empowers the escalated Editor to manipulate non-system roles, restore role backups, and write arbitrary plugin options prefixed with 'cme_', 'capsman', 'pp_capabilities', or 'presspermit'. This vulnerability is significant for organizations relying on the plugin to restrict user administrative tasks, as it effectively nullifies the separation of duties between Administrators and Editors regarding site capability management.

Impact

Successful exploitation allows authenticated users with the Editor role to gain unauthorized control over role-based access control (RBAC) configurations and plugin settings. This can lead to the unauthorized creation or deletion of roles, manipulation of non-administrator capabilities, and the modification of sensitive plugin options. This impacts the integrity and availability of access control within the WordPress environment, potentially facilitating further malicious activities by enabling an attacker to maintain elevated, unauthorized permissions within the administrative interface.

Recommendation

• Upgrade the PublishPress Capabilities plugin to a version beyond 2.50.0 immediately.
• Review WordPress audit logs for any role or capability changes initiated by user accounts assigned the 'Editor' role.
• Audit the 'wp_options' table for modifications to keys prefixed with 'cme_', 'capsman', 'pp_capabilities', or 'presspermit' to identify potential post-exploitation configuration changes.
• Temporarily revoke the 'Editor' role from suspicious accounts until the plugin is patched.