CVE-2026-28183
HighCVSS 7.2Summary
The PublishPress Capabilities (capability-manager-enhanced) WordPress plugin has an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 2.45.0.
Risk Assessment
A user with limited privileges can gain higher privileges, potentially leading to unauthorized access to sensitive functions and data.
Recommendation
Update the PublishPress Capabilities plugin to a version newer than 2.45.0 that includes a fix.
Other vulnerabilities in PublishPress Capabilities
See all- CVE-2026-94487High
The PublishPress Capabilities plugin in versions up to and including 2.50.1 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An attacker can trick a user into performing unwanted actions.
- CVE-2026-75927High
The PublishPress Capabilities plugin for WordPress up to version 2.50.0 is vulnerable to Privilege Escalation. The addPluginCapabilities() function automatically grants the Editor role all manage_capabilities_* capabilities, allowing attackers with Editor-level access to manage roles and plugin settings, but not full administrator access.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.