PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

CVE-2021-25032

CVE-2021-25032 PublishPress Capabilities 2.2 - 2.3 - 未认证的任意选项更新导致博客被入侵 描述 该插件在通过 init 钩子更新插件设置时，未进行授权和 CSRF 检查，也未确保要更新的选项属于该插件。因此，未认证的攻击者可以更新任意博客选项，例如默认角色，从而使任何新注册的用户都能获得管理员角色。 概念验证 root@kitploit: POST /wp-admin/admin.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01...

CVE-2026-75927

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

EUVD-2026-74758

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-75927 PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-75927 PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-75927

CVE-2026-75927 affects the PublishPress Capabilities WordPress plugin (all versions ≤ 2.50.0 ). The root cause is the addPluginCapabilities() function, which unconditionally grants the Editor role all 15 manage_capabilities_* capabilities via a hard-coded $eligible_roles assignment that executes ...

WordPress User Role Editor – PublishPress Capabilities: Access Control and User Roles plugin <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant vulnerability

Authenticated Editor+ Privilege Escalation to Fresh-Install Default Capability Grant vulnerability discovered by Wordfence PRISM in WordPress Plugin PublishPress Capabilities versions = 2.50.0...

CVE-2026-28183

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-28183

...

CVE-2026-28183

This CVE ID is rejected/not used and does not represent an active vulnerability entry.

EUVD-2026-53953

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-32394

Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through = 2.31.0...

EUVD-2026-11907

Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through = 2.31.0...

CVE-2026-32394

Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through = 2.31.0...

CVE-2026-32394

The CVE-2026-32394 entry concerns the WordPress PublishPress Capabilities plugin (capability-manager-enhanced) with a Broken Access Control/Missing Authorization issue. Affected component: PublishPress Capabilities, versions up to and including 2.31.0. Root cause: incorrectly configured access co...

CVE-2026-32394

Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through = 2.31.0...

CVE-2026-32394 WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through = 2.31.0...

CVE-2026-32394 WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through = 2.31.0...

WordPress plugin PublishPress Capabilities 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. WordPres...