# CVE-2026-48197: PublishPress Capabilities privilege escalation in capability-manager-enhanced

Source: https://junglewise.ai/threats/cve-2026-48197-incorrect-privilege-assignment-vulnerability-in-publishpress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-48197 · Severity: high · CVSS 7.2 · Published 2026-10-06

PublishPress Capabilities is a WordPress plugin that manages user roles and permissions. The plugin contains a privilege escalation flaw that allows a low-privilege user to gain administrator access and take full control of a WordPress site. Exploitation requires specific manual configuration changes by a site administrator, limiting the practical risk.

Vendors: [PublishPress](https://junglewise.ai/threats/vendors/publishpress).

## Quick answers

**Is CVE-2026-48197 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48197 being exploited in the wild.

**How severe is CVE-2026-48197?** High severity, with a CVSS score of 7.2, published 6 October 2026.

**Which products and versions are affected?** PublishPress Capabilities through 2.45.0.

**Is there a fix for CVE-2026-48197?** Yes: fixed in 2.50.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48197 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48197?** Check whether you run PublishPress Capabilities at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.50.0

## Technical details

An incorrect privilege assignment vulnerability in the capability-manager-enhanced component allows privilege escalation from a low-privilege user (such as an Editor) to administrator. The vulnerability requires Administrator-only settings changes to be manually configured on the site before exploitation is possible, meaning an attacker cannot escalate privileges on an unmodified installation. The flaw affects PublishPress Capabilities through version 2.45.0 and is fixed in 2.50.0.

## Affected products

- PublishPress Capabilities through 2.45.0

## Timeline

- 2026-07-18: disclosed
- 2026-08-05: advisory
- 2026-10-06: other: Public disclosure via NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/capability-manager-enhanced/vulnerability/wordpress-publishpress-capabilities-plugin-2-45-0-privilege-escalation-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/capability-manager-enhanced/vulnerability/wordpress-publishpress-capabilities-plugin-2-45-0-privilege-escalation-vulnerability?_s_id=cve)

## Related threats

- [PublishPress Capabilities cross-site request forgery](https://junglewise.ai/threats/cve-2026-94487-unauthenticated-cross-site-request-forgery-csrf-in-publishpress)