CVE-2026-109900

The Melapress Role Editor plugin for WordPress (through version 1.3.0) contains an incorrect privilege assignment vulnerability that allows privilege escalation. A low-privileged user can gain a higher level of access within the system.

Privilege escalation in a role management plugin may allow an attacker to take administrative control of the WordPress site. This poses a serious threat to the confidentiality and integrity of the entire installation.

Update Melapress Role Editor to a version later than 1.3.0 or disable it if no fix is available. Review existing user roles and permissions for unauthorized changes.