Capability Manager Enhanced Vulnerabilities

The PublishPress Capabilities: User Role Access Control, Admin Area Permissions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.50.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perfo...

CVSS:

4.3

(Wordfence)

Affected:

up to 2.50.1

Fixed in:

2.51.0

Disclosed:

Sep 23, 2026

CVE-2026-94487 on NVD →

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capa...

CVSS:

7.2

(Wordfence)

Affected:

up to 2.50.0

Fixed in:

2.50.1

Disclosed:

Sep 8, 2026

CVE-2026-75927 on NVD →

The PublishPress Capabilities: User Role Access Control, Admin Area Permissions plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.45.0. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attac...

CVSS:

4.7

(Wordfence)

Affected:

up to 2.45.0

Fixed in:

2.50.0

Disclosed:

Aug 5, 2026

CVE-2026-28183 on NVD →

The PublishPress Capabilities: User Role Access Control, Admin Area Permissions plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.45.0. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attac...

CVSS:

4.7

(Wordfence)

Affected:

up to 2.45.0

Fixed in:

2.50.0

Disclosed:

Aug 5, 2026

CVE-2026-48197 on NVD →

The PublishPress Capabilities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.31.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

(Wordfence)

Affected:

up to 2.31.0

Fixed in:

2.32.0

Disclosed:

Feb 20, 2026

CVE-2026-32394 on NVD →

The PublishPress Capabilities plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.5.1 via deserialization of untrusted input when processing an import file. This allows administrator-level attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a...

CVSS:

7.2

(Wordfence)

Affected:

up to 2.5.1

Fixed in:

2.5.2

Disclosed:

Oct 10, 2022

CVE-2022-3366 on NVD →

The PublishPress Capabilities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via a form action URL in versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVSS:

6.1

(Wordfence)

Affected:

up to 2.3.2

Fixed in:

2.3.3

Disclosed:

Jan 13, 2022

The PublishPress Capabilities WordPress plugin before 2.3.1, PublishPress Capabilities Pro WordPress plugin before 2.3.1 does not have authorisation and CSRF checks when updating the plugin's settings via the init hook, and does not ensure that the options to be updated belong to the plugin. As a result, unauthenticate...

CVSS:

9.8

(Wordfence)

Affected:

up to 2.3.1

Fixed in:

2.3.1

Disclosed:

Dec 8, 2021

CVE-2021-25032 on NVD →

The PublishPress Capabilities plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 1.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for role-editing-capable at...

CVSS:

7.2

(Wordfence)

Affected:

up to 1.5.9

Fixed in:

1.5.9

Disclosed:

Jun 20, 2018