CVE-2026-94487
HighCVSS 8.1Summary
The PublishPress Capabilities plugin in versions up to and including 2.50.1 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An attacker can trick a user into performing unwanted actions.
Risk Assessment
An unauthenticated attacker could trick a logged-in administrator into performing unauthorized operations, potentially leading to privilege or site configuration changes.
Recommendation
Update the PublishPress Capabilities plugin to a version newer than 2.50.1.
Other vulnerabilities in PublishPress Capabilities
See all- CVE-2026-28183High
The PublishPress Capabilities (capability-manager-enhanced) WordPress plugin has an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 2.45.0.
- CVE-2026-75927High
The PublishPress Capabilities plugin for WordPress up to version 2.50.0 is vulnerable to Privilege Escalation. The addPluginCapabilities() function automatically grants the Editor role all manage_capabilities_* capabilities, allowing attackers with Editor-level access to manage roles and plugin settings, but not full administrator access.
Original NVD description (English source)
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.