CVE-2026-48197: WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress PublishPress Capabilitiesto a version that resolves this vulnerability.Fixed in 2.50.0
Event History
Frequently Asked Questions
What level of access does an attacker need?
The CVSS vector indicates that an attacker must already hold high privileges. The issue is network-accessible, has low attack complexity, and does not require user interaction.
What security impact could successful exploitation have?
Successful exploitation is rated as having high impact on confidentiality, integrity, and availability. It enables privilege escalation through incorrect privilege assignment.
Which versions should be treated as affected?
PublishPress Capabilities versions through 2.45.0 are affected. The available data does not establish a specific earliest affected version.