CVE-2026-75927: PublishPress Capabilities Privilege Escalation

CVE-2026-75927 Overview

CVE-2026-75927 is a privilege escalation vulnerability in the PublishPress Capabilities plugin for WordPress, also known as User Role Editor, Access Permissions, User Capabilities, Admin Menus. All versions up to and including 2.50.0 are affected. The addPluginCapabilities() function unconditionally grants the Editor role 15 manage_capabilities_* capabilities during the first admin_init after plugin activation. Authenticated attackers with Editor-level access can elevate their privileges to a site-wide capability manager. This weakness maps to Improper Privilege Management [CWE-269].

Critical Impact
An authenticated Editor can create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options prefixed with cme_, capsman, pp_capabilities, or presspermit.

Affected Products

PublishPress Capabilities plugin for WordPress — all versions up to and including 2.50.0
Sites where the plugin was activated at least once and reached the first admin_init
WordPress installations exposing Editor-level accounts to untrusted or lower-trust users

Discovery Timeline

2026-09-09 - CVE CVE-2026-75927 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-75927

Vulnerability Analysis

The flaw exists in the plugin's installer path. On the first admin_init after activation, addPluginCapabilities() executes with a hard-coded $eligible_roles = ['administrator', 'editor'] assignment. The function persists the grants directly to the WordPress options database with no administrator opt-in or confirmation.

The grant covers all 15 manage_capabilities_* capabilities. These include manage_capabilities, manage_capabilities_roles, manage_capabilities_settings, and manage_capabilities_backup. Editor accounts therefore gain access to every role-management and plugin-settings screen gated only on these capabilities.

WordPress's map_meta_cap layer prevents the escalated Editor from granting administrator-only capabilities to other roles. The Editor cannot achieve full Administrator access. However, all functionality gated solely on manage_capabilities_* remains fully reachable.

Root Cause

The root cause is Improper Privilege Management [CWE-269]. The installer treats Editors as trusted capability administrators by default. No policy check, nonce prompt, or administrator approval gates the initial capability assignment. The grant is written to persistent storage, so it survives deactivation and reactivation cycles.

Attack Vector

An authenticated Editor visits any authenticated admin endpoint after plugin activation. The escalated capabilities are then usable directly through the plugin's admin pages and update_option() handlers. The attacker can create arbitrary non-system roles, restore role backups, and write plugin options whose names begin with cme_, capsman, pp_capabilities, or presspermit. See the Wordfence Vulnerability Report and the WordPress Capability Manager Code for technical detail. No exploit code is provided here because no verified proof-of-concept has been published.

Detection Methods for CVE-2026-75927

Indicators of Compromise

Editor role objects in wp_options (wp_user_roles) containing any manage_capabilities_* capability set to true.
Unexpected non-system role additions, renames, or deletions performed by a non-Administrator user.
New or modified WordPress options with names beginning with cme_, capsman, pp_capabilities, or presspermit written by an Editor account.
Presence of PublishPress Capabilities plugin at version 2.50.0 or earlier with active Editor accounts.

Detection Strategies

Query the wp_options table for the serialized wp_user_roles value and audit whether the editor role carries any manage_capabilities_* capability.
Enable WordPress activity logging to record role and capability changes and correlate them with the acting user's role at the time.
Alert on administrative page loads under the plugin's capsman or pp-capabilities admin slugs initiated by non-Administrator sessions.

Monitoring Recommendations

Monitor web server access logs for authenticated requests to plugin admin endpoints originating from Editor accounts.
Track database update_option() writes touching options prefixed with cme_, capsman, pp_capabilities, or presspermit.
Alert on role backup restore events, which are gated on manage_capabilities_backup and would otherwise be Administrator-only actions.

How to Mitigate CVE-2026-75927

Immediate Actions Required

Update the PublishPress Capabilities plugin to a fixed version released after 2.50.0. Review the WordPress Changeset Overview for the vendor fix.
Audit the Editor role and remove any manage_capabilities_* capabilities that were persisted by the vulnerable installer.
Review all Editor-level accounts and revoke any that are no longer required or that show signs of misuse.
Inspect non-system roles, role backups, and plugin options with the affected prefixes for unauthorized modification.

Patch Information

Apply the plugin update published in the vendor changeset referenced above. The fix removes the unconditional Editor grant from the installer and no longer persists manage_capabilities_* capabilities to the Editor role without administrator opt-in.

Workarounds

Deactivate the PublishPress Capabilities plugin until the patched version can be installed.
Manually strip manage_capabilities_* capabilities from the Editor role using WP-CLI or a trusted role editor executed under an Administrator account.
Temporarily restrict Editor account creation and downgrade untrusted Editors to Author or Contributor until the patched version is deployed.

bash

# Remove manage_capabilities_* grants from the Editor role using WP-CLI
wp cap remove editor manage_capabilities
wp cap remove editor manage_capabilities_roles
wp cap remove editor manage_capabilities_settings
wp cap remove editor manage_capabilities_backup

# Confirm the Editor role no longer holds any manage_capabilities_* capability
wp cap list editor | grep manage_capabilities