CVE-2026-48197: WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Q: What level of access does an attacker need?

The CVSS vector indicates that an attacker must already hold high privileges. The issue is network-accessible, has low attack complexity, and does not require user interaction.

Q: What security impact could successful exploitation have?

Successful exploitation is rated as having high impact on confidentiality, integrity, and availability. It enables privilege escalation through incorrect privilege assignment.

Q: Which versions should be treated as affected?

PublishPress Capabilities versions through 2.45.0 are affected. The available data does not establish a specific earliest affected version.

Published Oct 6, 2026

Updated

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

Affected Software

1 affected component

PublishPress PublishPress Capabilities<=2.45.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress PublishPress Capabilities to a version that resolves this vulnerability.
Fixed in 2.50.0

Event History

Oct 6, 2026

CVE Published

via MITRE·08:35 AM

Data Sourced

via MITRE·08:35 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The CVSS vector indicates that an attacker must already hold high privileges. The issue is network-accessible, has low attack complexity, and does not require user interaction.

What security impact could successful exploitation have?

Successful exploitation is rated as having high impact on confidentiality, integrity, and availability. It enables privilege escalation through incorrect privilege assignment.

Which versions should be treated as affected?

PublishPress Capabilities versions through 2.45.0 are affected. The available data does not establish a specific earliest affected version.

CVE-2026-48197: WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need?

What security impact could successful exploitation have?

Which versions should be treated as affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need?

What security impact could successful exploitation have?

Which versions should be treated as affected?