Executive brief
The Content Mask WordPress plugin is used to create redirect and embed masks for content on WordPress sites. A flaw in the plugin allows low-privilege users (Contributors) to publish posts and pages without the required capabilities, enabling unauthorized content publication and potential abuse to redirect site visitors to attacker-controlled pages.
Technical details
The plugin fails to validate the user's publishing capabilities before allowing creation of new content masks via the create_new_content_mask AJAX action. The vulnerability is a privilege escalation flaw (CWE-269) that allows Contributors with only valid CSRF and nonce tokens to create published posts/pages with post_status=publish, bypassing WordPress's capability checks. An authenticated attacker with Contributor role can exploit this through a direct POST to admin-ajax.php to create redirects or embeds that expose content or phish site visitors. The plugin validates CSRF tokens and nonces but fails to check the publish_posts capability before creating content. The issue was fixed in version 1.8.5.5.
Affected products
- Automattic Content Mask 1.8.0 through 1.8.5.4
Timeline
- 2026-08-21: disclosed
- 2026-08-23: patched: Fixed in version 1.8.5.5