CVE-2026-9842
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
The Backstage - Customizer Demo Access plugin for WordPress up to version 1.4.2 is vulnerable to privilege escalation. This is due to assigning the overly permissive `manage_options` capability to the `backstage_customizer_user` demo role, allowing unauthenticated attackers to exit the Customizer and modify WordPress options like `default_role`.
Risk Assessment
An unauthenticated attacker can escalate privileges by changing the default user role to administrator, leading to full site takeover.
Recommendation
Immediately update the Backstage - Customizer Demo Access plugin to the latest available version. If no update is available, temporarily disable the plugin until a patch is released.
Original NVD description (English source)
The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the `manage_options` capability to the `backstage_customizer_user` demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as `default_role`, leading to privilege escalation.