Melapress Role Editor: Incorrect privilege assignment vulnerability (CVE-2026-109900)
An incorrect privilege assignment vulnerability in Melapress Role Editor versions 1.3.0 and prior enables unprivileged users to perform unauthorized privilege escalation.
CVE search metadata
CVE search record: CVE-2026-109900. Severity: critical. CVSS: 9.6. KEV: no. Product: Melapress Role Editor (<= 1.3.0). Brief: Melapress Role Editor: Incorrect privilege assignment vulnerability (CVE-2026-109900). Brief link: https://feed.craftedsignal.io/briefs/2026-11-melapress-role-editor-privilege-escalation/
Triage facts
Revision 1- Applicability
- Melapress Role Editor (<= 1.3.0)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 8, 17:31 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Melapress Role Editor is affected by an incorrect privilege assignment vulnerability (CVE-2026-109900). The flaw allows an unprivileged user to escalate their permissions within the WordPress environment. This vulnerability affects all versions from n/a through 1.3.0. No patch information is currently disclosed.
Impact
Successful exploitation allows unprivileged users to gain elevated privileges, potentially leading to full administrative control over the affected WordPress installation.
Recommendation
- Inventory all WordPress instances running the Melapress Role Editor plugin.
- Monitor administrative logs for unauthorized creation or modification of user roles and elevated privilege assignments.
- Disable or restrict access to the plugin until a security update is released by the vendor.
Immediate actions
Audit WordPress user accounts and active roles for unexpected administrative privilege assignments.
Threat Hunt
Identify unauthorized changes to user roles or capabilities within the WordPress database or management interface.
Data: WordPress administrative logs, Database audit logs for wp_users and wp_usermeta tables
Mitigations
Disable the Melapress Role Editor plugin until a patch is released.
CVE-2026-109900