CVE-2026-109899: WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability

Q: Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and can exploit the issue remotely over the network without user interaction.

Q: What is the potential impact?

Successful exploitation may expose highly sensitive information and allow a limited integrity impact. The vulnerability does not indicate an availability impact.

Q: Which plugin versions are affected?

Melapress Role Editor versions through 1.3.0 are affected. The available data does not identify a fixed version.

Published Nov 8, 2026

Updated

Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Melapress Role Editor to a version that resolves this vulnerability.
Fixed in 1.4.0

Event History

Nov 8, 2026

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges (PR:L) and can exploit the issue remotely over the network without user interaction.

What is the potential impact?

Successful exploitation may expose highly sensitive information and allow a limited integrity impact. The vulnerability does not indicate an availability impact.

Which plugin versions are affected?

Melapress Role Editor versions through 1.3.0 are affected. The available data does not identify a fixed version.

CVE-2026-109899: WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the potential impact?

Which plugin versions are affected?