PublishPress Capabilities <= 2.50.0 — Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under PublishPress Capabilities: User Role Access Control, Admin Area Permissions.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 2.50.1, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch PublishPress Capabilities: User Role Access Control, Admin Area Permissions to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Wordfence PRISM.

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligible_roles = ['administrator', 'editor']` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress's `map_meta_cap` layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on `manage_capabilities_*` capabilities remains fully accessible.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Sep 8, 2026

   CVE published

   Severity high, CVSS 7.2

2. Nov 13, 2026

   Record last updated