{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/publishpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:publishpress:capabilities:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-75927"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus (\u003c= 2.50.0)"],"_cs_severities":["high"],"_cs_tags":["wordpress","privilege-escalation","web-application"],"_cs_type":"advisory","_cs_vendors":["PublishPress"],"content_html":"\u003cp\u003eThe PublishPress Capabilities plugin for WordPress, specifically in versions 2.50.0 and earlier, is vulnerable to an unauthorized privilege escalation flaw. The issue resides within the 'addPluginCapabilities()' function, which executes automatically during the 'admin_init' hook upon plugin activation. This function unilaterally grants the WordPress 'Editor' role fifteen distinct 'manage_capabilities_*' capabilities, such as 'manage_capabilities', 'manage_capabilities_roles', and 'manage_capabilities_settings', without requiring administrator verification or opt-in.\u003c/p\u003e\n\u003cp\u003eBecause these capability assignments are persisted directly into the site's database, an authenticated user already holding the 'Editor' role can gain control over role management and plugin configuration settings. While this does not bypass WordPress's internal 'map_meta_cap' logic to provide full administrative control, it empowers the escalated Editor to manipulate non-system roles, restore role backups, and write arbitrary plugin options prefixed with 'cme_', 'capsman', 'pp_capabilities', or 'presspermit'. This vulnerability is significant for organizations relying on the plugin to restrict user administrative tasks, as it effectively nullifies the separation of duties between Administrators and Editors regarding site capability management.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows authenticated users with the Editor role to gain unauthorized control over role-based access control (RBAC) configurations and plugin settings. This can lead to the unauthorized creation or deletion of roles, manipulation of non-administrator capabilities, and the modification of sensitive plugin options. This impacts the integrity and availability of access control within the WordPress environment, potentially facilitating further malicious activities by enabling an attacker to maintain elevated, unauthorized permissions within the administrative interface.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the PublishPress Capabilities plugin to a version beyond 2.50.0 immediately.\u003c/li\u003e\n\u003cli\u003eReview WordPress audit logs for any role or capability changes initiated by user accounts assigned the 'Editor' role.\u003c/li\u003e\n\u003cli\u003eAudit the 'wp_options' table for modifications to keys prefixed with 'cme_', 'capsman', 'pp_capabilities', or 'presspermit' to identify potential post-exploitation configuration changes.\u003c/li\u003e\n\u003cli\u003eTemporarily revoke the 'Editor' role from suspicious accounts until the plugin is patched.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-09T08:48:24Z","date_published":"2026-09-09T08:48:24Z","id":"https://feed.craftedsignal.io/briefs/2026-09-publishpress-privilege-escalation/","summary":"The PublishPress Capabilities WordPress plugin (\u003c= 2.50.0) contains a privilege escalation vulnerability that automatically grants 'Editor' users full site-wide capability management permissions without administrative consent.","title":"Privilege Escalation in PublishPress Capabilities Plugin","url":"https://feed.craftedsignal.io/briefs/2026-09-publishpress-privilege-escalation/"}],"language":"en","title":"CraftedSignal Threat Feed - PublishPress","version":"https://jsonfeed.org/version/1.1"}