CVE-2026-9842: Backstage <= 1.4.2 - Unauthenticated Privilege Escalation via Permissive Demo Role Capabilities
The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the manageoptions capability to the backstagecustomizeruser demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as defaultrole, leading to privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Backstage - Customizer Demo Access plugin for WordPressto a version that resolves this vulnerability.Fixed in 1.4.2 - Configuration
Update the plugin so the demo role `backstage_customizer_user` is not granted the `manage_options` capability (it should have only Customizer-only demo access capabilities).
Backstage - Customizer Demo Access plugin for WordPress capability assignment = remove manage_options from demo role backstage_customizer_user - Compensating control
Temporarily restrict unauthenticated access to any WordPress endpoints that allow Customizer demo access, to prevent attackers from navigating beyond the Customizer and updating options like `default_role` until the plugin is fixed.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9842?
CVE-2026-9842 has a high severity rating of 7.5.
How do I fix CVE-2026-9842?
To fix CVE-2026-9842, upgrade the Backstage - Customizer Demo Access plugin to version 1.4.3 or later.
What type of vulnerability is CVE-2026-9842?
CVE-2026-9842 is an unauthenticated privilege escalation vulnerability.
What software is affected by CVE-2026-9842?
CVE-2026-9842 affects the Backstage - Customizer Demo Access plugin for WordPress up to version 1.4.2.
What impact does CVE-2026-9842 have on the system?
CVE-2026-9842 allows unauthorized users to gain elevated privileges on the WordPress site.