CVE-2026-94487: PublishPress Capabilities CSRF Vulnerability

CVE-2026-94487 Overview

CVE-2026-94487 is an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability affecting the PublishPress Capabilities WordPress plugin in versions up to and including 2.50.1. The plugin manages user roles and permissions across WordPress sites, making capability-related state changes an attractive target for attackers. An attacker can craft a malicious web page or link that, when visited by an authenticated administrator, triggers unintended state-changing actions on the target WordPress site. The vulnerability maps to CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation lets an attacker modify plugin state or user capabilities on behalf of a logged-in administrator, degrading site integrity and availability.

Affected Products

PublishPress Capabilities plugin (also distributed as capability-manager-enhanced) for WordPress
All versions up to and including 2.50.1
WordPress sites where an administrator can be lured to attacker-controlled content while authenticated

Discovery Timeline

2026-09-23 - CVE-2026-94487 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94487

Vulnerability Analysis

The vulnerability exists because the PublishPress Capabilities plugin processes a state-changing request without verifying that the request originated from a legitimate, intentional user action. WordPress provides nonce APIs such as wp_nonce_field(), check_admin_referer(), and wp_verify_nonce() to bind requests to a specific user session. When these checks are missing or improperly enforced on a privileged endpoint, any origin can submit the request on behalf of a signed-in user.

Exploitation requires user interaction, typically an administrator following a crafted link or loading attacker-controlled content in the same browser session used for WordPress administration. Because the action executes with the victim's privileges, an attacker gains the ability to alter integrity-sensitive state and disrupt availability without needing valid credentials of their own.

Root Cause

The root cause is missing or inadequate CSRF protection on privileged plugin actions. The affected handler in capability-manager-enhanced accepts a state-changing HTTP request without validating a nonce or verifying the request's Origin/Referer against the site. This omission satisfies the classic [CWE-352] pattern, where the server cannot distinguish a forged cross-site request from a legitimate one initiated inside the admin dashboard.

Attack Vector

The attack is network-based and requires no authentication from the attacker. The attacker hosts a page containing an auto-submitting HTML form or image tag that targets the vulnerable plugin endpoint on a victim WordPress site. When an authenticated administrator visits that page, the browser attaches the WordPress session cookies and issues the request. The plugin processes the request as if the administrator had initiated it, applying the attacker-chosen changes to capabilities or plugin configuration.

Refer to the Patchstack Plugin Vulnerability Advisory for endpoint-specific details.

Detection Methods for CVE-2026-94487

Indicators of Compromise

Unexpected changes to WordPress user roles or capabilities managed by PublishPress Capabilities, without a corresponding admin audit-log entry.
Requests to capability-manager-enhanced plugin endpoints where the HTTP Referer header points to an external domain rather than the site's own admin area.
Administrator sessions performing plugin actions immediately after visiting external links or opening third-party email content.

Detection Strategies

Review web server and WordPress access logs for POST requests to wp-admin/admin.php?page=pp-capabilities* or related plugin endpoints originating from off-site referrers.
Enable a WordPress audit-logging plugin to record capability and role changes, and alert on modifications outside change windows.
Correlate administrator browser activity with plugin state changes to identify user-interaction-driven exploitation.

Monitoring Recommendations

Monitor for new or modified administrator-equivalent capabilities across user roles.
Alert on outbound admin requests missing the expected WordPress nonce parameters (_wpnonce, _ajax_nonce).
Track the installed version of the PublishPress Capabilities plugin across managed WordPress instances to identify hosts still on <= 2.50.1.

How to Mitigate CVE-2026-94487

Immediate Actions Required

Upgrade PublishPress Capabilities to a version later than 2.50.1 as soon as a fixed release is available from the vendor.
Audit WordPress user roles and capabilities for unauthorized modifications and revert unexpected changes.
Instruct administrators to sign out of WordPress before browsing untrusted sites or opening links from unverified sources.

Patch Information

Consult the Patchstack Plugin Vulnerability Advisory for the current fixed version and vendor guidance. Apply the plugin update through the WordPress admin dashboard or via wp-cli once the patched release is published.

Workarounds

Deactivate the PublishPress Capabilities plugin until a patched version is installed if capability management is not actively required.
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to plugin endpoints when the Referer header does not match the site's own hostname.
Enforce short administrator session lifetimes and require re-authentication for privileged actions to reduce the exploitation window.

bash

# Configuration example: update the plugin using wp-cli once a fixed version is released
wp plugin update capability-manager-enhanced

# Or temporarily deactivate the plugin as a workaround
wp plugin deactivate capability-manager-enhanced