{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/melapress-role-editor--1.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:melapress:melapress_role_editor:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":9.6,"id":"CVE-2026-109900"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Melapress Role Editor (\u003c= 1.3.0)"],"_cs_severities":["critical"],"_cs_tags":["wordpress","privilege-escalation","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Melapress"],"content_html":"\u003cp\u003eMelapress Role Editor is affected by an incorrect privilege assignment vulnerability (CVE-2026-109900). The flaw allows an unprivileged user to escalate their permissions within the WordPress environment. This vulnerability affects all versions from n/a through 1.3.0. No patch information is currently disclosed.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unprivileged users to gain elevated privileges, potentially leading to full administrative control over the affected WordPress installation.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eInventory all WordPress instances running the Melapress Role Editor plugin.\u003c/li\u003e\n\u003cli\u003eMonitor administrative logs for unauthorized creation or modification of user roles and elevated privilege assignments.\u003c/li\u003e\n\u003cli\u003eDisable or restrict access to the plugin until a security update is released by the vendor.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-08T17:31:01Z","date_published":"2026-11-08T17:31:01Z","id":"https://feed.craftedsignal.io/briefs/2026-11-melapress-role-editor-privilege-escalation/","summary":"An incorrect privilege assignment vulnerability in Melapress Role Editor versions 1.3.0 and prior enables unprivileged users to perform unauthorized privilege escalation.","title":"Melapress Role Editor: Incorrect privilege assignment vulnerability (CVE-2026-109900)","url":"https://feed.craftedsignal.io/briefs/2026-11-melapress-role-editor-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - Melapress Role Editor (\u003c= 1.3.0)","version":"https://jsonfeed.org/version/1.1"}