Because these capability assignments are persisted directly into the site's database, an authenticated user already holding the 'Editor' role can gain control over role management and plugin configuration settings. While this does not bypass WordPress's internal 'map_meta_cap' logic to provide full administrative control, it empowers the escalated Editor to manipulate non-system roles, restore role backups, and write arbitrary plugin options prefixed with 'cme_', 'capsman', 'pp_capabilities', or 'presspermit'. This vulnerability is significant for organizations relying on the plugin to restrict user administrative tasks, as it effectively nullifies the separation of duties between Administrators and Editors regarding site capability management.

Impact

Successful exploitation allows authenticated users with the Editor role to gain unauthorized control over role-based access control (RBAC) configurations and plugin settings. This can lead to the unauthorized creation or deletion of roles, manipulation of non-administrator capabilities, and the modification of sensitive plugin options. This impacts the integrity and availability of access control within the WordPress environment, potentially facilitating further malicious activities by enabling an attacker to maintain elevated, unauthorized permissions within the administrative interface.

Recommendation

• Upgrade the PublishPress Capabilities plugin to a version beyond 2.50.0 immediately.
• Review WordPress audit logs for any role or capability changes initiated by user accounts assigned the 'Editor' role.
• Audit the 'wp_options' table for modifications to keys prefixed with 'cme_', 'capsman', 'pp_capabilities', or 'presspermit' to identify potential post-exploitation configuration changes.
• Temporarily revoke the 'Editor' role from suspicious accounts until the plugin is patched.