Cpe:2.3:a:melapress:melapress_role_editor:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3amelapressmelapress_role_editorwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 08 Nov 2026 17:31:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMelapress Role Editor: Incorrect privilege assignment vulnerability (CVE-2026-109900)https://feed.craftedsignal.io/briefs/2026-11-melapress-role-editor-privilege-escalation/Sun, 08 Nov 2026 17:31:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-melapress-role-editor-privilege-escalation/An incorrect privilege assignment vulnerability in Melapress Role Editor versions 1.3.0 and prior enables unprivileged users to perform unauthorized privilege escalation.Melapress Role Editor is affected by an incorrect privilege assignment vulnerability (CVE-2026-109900). The flaw allows an unprivileged user to escalate their permissions within the WordPress environment. This vulnerability affects all versions from n/a through 1.3.0. No patch information is currently disclosed.

Impact

Successful exploitation allows unprivileged users to gain elevated privileges, potentially leading to full administrative control over the affected WordPress installation.

Recommendation

  • Inventory all WordPress instances running the Melapress Role Editor plugin.
  • Monitor administrative logs for unauthorized creation or modification of user roles and elevated privilege assignments.
  • Disable or restrict access to the plugin until a security update is released by the vendor.
]]>criticaladvisorywordpressprivilege-escalationvulnerability