CVE-2026-75927: PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the addPluginCapabilities() function unconditionally granting the Editor role all 15 managecapabilities capabilities — including managecapabilities, managecapabilitiesroles, managecapabilitiessettings, and managecapabilitiesbackup — via a hard-coded $eligibleroles = ['administrator', 'editor'] assignment that runs automatically on the first admininit after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with cme, capsman, ppcapabilities, or presspermit via updateoption(). The escalation stops short of full Administrator access, as WordPress's mapmetacap layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on managecapabilities capabilities remains fully accessible.