PublishPress Capabilities < 2.3.1 - Missing Authorization

The PublishPress Capabilities plugin for WordPress before 2.3.1 does not have proper authorization and CSRF checks when updating settings via the init hook, allowing unauthenticated attackers to update arbitrary blog options, such as setting the default role to administrator. id: CVE-2021-25032...

CVE-2021-25032

CVE-2021-25032 PublishPress Capabilities 2.2 - 2.3 - Unauthenticated Arbitrary Options Update to Blog Compromise Description The plugin does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to t...

VulnCheck KEV: CVE-2026-75927

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

CVE-2026-48197

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0...

CVE-2026-48197

The PublishPress Capabilities plugin for WordPress (versions n/a through 2.45.0 ) contains an Incorrect Privilege Assignment vulnerability in the capability-manager-enhanced component. This flaw allows for Privilege Escalation , potentially enabling an attacker to gain unauthorized higher-level p...

CVE-2026-48197 WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0...

CVE-2026-48197 WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0...

EUVD-2026-93061

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0...

CVE-2026-48197: Incorrect Privilege Assignment

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0...

PT-2026-106483

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0...

CVE-2026-94487

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94487 WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

EUVD-2026-85480

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94487

The PublishPress Capabilities WordPress plugin, in versions

WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Intrudify in WordPress Plugin PublishPress Capabilities versions = 2.50.1...

PT-2026-97465

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-94487: Cross-Site Request Forgery (CSRF)

Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...

CVE-2026-75927

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...

EUVD-2026-74758

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities function unconditionally granting the Editor role...