PublishPress Capabilities vulnerabilities
3 known CVE vulnerabilities in PublishPress Capabilities, translated and rated.
- CVE-2026-94487High
The PublishPress Capabilities plugin in versions up to and including 2.50.1 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An attacker can trick a user into performing unwanted actions.
- CVE-2026-28183High
The PublishPress Capabilities (capability-manager-enhanced) WordPress plugin has an incorrect privilege assignment vulnerability that allows privilege escalation. This issue affects versions from n/a through 2.45.0.
- CVE-2026-75927High
The PublishPress Capabilities plugin for WordPress up to version 2.50.0 is vulnerable to Privilege Escalation. The addPluginCapabilities() function automatically grants the Editor role all manage_capabilities_* capabilities, allowing attackers with Editor-level access to manage roles and plugin settings, but not full administrator access.