Is CVE-2026-75927 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-75927 being exploited in the wild.

How severe is CVE-2026-75927?

High severity, with a CVSS score of 7.2, published 9 September 2026.

Which products and versions are affected?

PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus up to and including 2.50.0.

Is there a fix for CVE-2026-75927?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-75927 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-75927?

Check whether you run PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities or Admin Menus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-75927: PublishPress Capabilities privilege escalation

CVE-2026-75927 · Severity: high · CVSS 7.2 · Published 2026-09-09

PublishPress Capabilities is a WordPress plugin that manages user roles and permissions on websites. A flaw in the plugin automatically grants Editor-level users elevated privileges to manage site roles and capabilities upon activation, without requiring administrator approval. This allows editors to modify permissions, create or delete roles, and change plugin settings that should be restricted to administrators.

Vendors: PublishPress.

Quick answers

Is CVE-2026-75927 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-75927 being exploited in the wild.
How severe is CVE-2026-75927?: High severity, with a CVSS score of 7.2, published 9 September 2026.
Which products and versions are affected?: PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus up to and including 2.50.0.
Is there a fix for CVE-2026-75927?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-75927 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-75927?: Check whether you run PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities or Admin Menus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the `addPluginCapabilities()` function, which unconditionally grants 15 `manage_capabilities_*` capabilities to the Editor role via a hard-coded role assignment during the first `admin_init` action after plugin activation. This occurs without explicit administrator consent and persists directly to the WordPress database. An authenticated attacker with Editor-level access can exploit this to elevate privileges and manage non-administrator roles, modify their capabilities, restore role backups, and write arbitrary plugin options matching specific prefixes. The escalation is limited by WordPress's `map_meta_cap` layer, which still prevents granting of administrator-only capabilities; however, all role-management and plugin-configuration features gated solely on `manage_capabilities_*` capabilities remain fully accessible.

Affected products

PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus up to and including 2.50.0

Timeline

2026-09-09: disclosed
other: CVE-2026-75927 assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.