CVE-2026-75927

The PublishPress Capabilities plugin for WordPress (user role editor, access permissions, and capability management) contains a privilege-escalation flaw (CWE-269) in which the addPluginCapabilities() function hard-codes the Editor role into the list of roles granted all 15 manage_capabilities_* capabilities. This grant runs automatically on the first admin_init after plugin activation, with no administrator opt-in, and is persisted directly to the database. An attacker who gains control of an Editor-level account can therefore act as a site-wide capability manager: creating, renaming, and deleting non-system roles, modifying capabilities of non-administrator roles, restoring role backups, and writing arbitrary plugin options whose names begin with cme_, capsman, pp_capabilities, or presspermit via update_option(). The escalation stops short of full Administrator access, because WordPress's map_meta_cap layer still prevents the escalated Editor from granting administrator-only capabilities to other roles, but all role-management and plugin-settings functionality gated solely on manage_capabilities_* capabilities is exposed. All sites running any version up to and including 2.50.0 are affected; no public proof-of-concept or in-the-wild exploitation is currently known.

What to do: Update the plugin to the latest available release newer than 2.50.0 as soon as a patched version is published, since the advisory does not specify a fixed version number. As an interim check, inspect the Editor role for the automatically granted manage_capabilities_* capabilities (including manage_capabilities, manage_capabilities_roles, manage_capabilities_settings, and manage_capabilities_backup), remove grants not wanted, and review non-system roles and cme_/capsman/pp_capabilities/presspermit-named options for unexpected changes. Because exploitation requires Editor-level access, restrict and monitor Editor accounts on affected sites.