Executive brief
PublishPress Capabilities is a WordPress plugin that manages user roles and permissions on websites. A flaw in the plugin automatically grants Editor-level users elevated privileges to manage site roles and capabilities upon activation, without requiring administrator approval. This allows editors to modify permissions, create or delete roles, and change plugin settings that should be restricted to administrators.
Technical details
The vulnerability exists in the `addPluginCapabilities()` function, which unconditionally grants 15 `manage_capabilities_*` capabilities to the Editor role via a hard-coded role assignment during the first `admin_init` action after plugin activation. This occurs without explicit administrator consent and persists directly to the WordPress database. An authenticated attacker with Editor-level access can exploit this to elevate privileges and manage non-administrator roles, modify their capabilities, restore role backups, and write arbitrary plugin options matching specific prefixes. The escalation is limited by WordPress's `map_meta_cap` layer, which still prevents granting of administrator-only capabilities; however, all role-management and plugin-configuration features gated solely on `manage_capabilities_*` capabilities remain fully accessible.
Affected products
- PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus up to and including 2.50.0
Timeline
- 2026-09-09: disclosed
- other: CVE-2026-75927 assigned