CVE-2026-48197
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The PublishPress Capabilities plugin (capability-manager-enhanced) versions up to 2.45.0 contain an Incorrect Privilege Assignment vulnerability that allows privilege escalation. This means a user can gain higher privileges than intended.
Risk Assessment
Privilege escalation can lead to full system compromise, access to sensitive data, or modification of security settings.
Recommendation
It is recommended to update the PublishPress Capabilities plugin to the latest version that includes a fix for this vulnerability.
Other vulnerabilities in PublishPress Capabilities
See all- CVE-2026-94487High
The PublishPress Capabilities plugin in versions up to and including 2.50.1 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An attacker can trick a user into performing unwanted actions.
- CVE-2026-75927High
The PublishPress Capabilities plugin for WordPress up to version 2.50.0 is vulnerable to Privilege Escalation. The addPluginCapabilities() function automatically grants the Editor role all manage_capabilities_* capabilities, allowing attackers with Editor-level access to manage roles and plugin settings, but not full administrator access.
- CVE-2026-28183High
The PublishPress Capabilities (capability-manager-enhanced) WordPress plugin has an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 2.45.0.
Original NVD description (English source)
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS