PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.8.4 - Missing Authorization to Supplemental Role Removal
- ID
- WPSEC-2026-0322
- Plugin
- PublishPress Permissions: Access Control, Content Permissions, User Access (press-permit-core)
- Affected
- from 3.7.1 before 4.9.0
- Remediation
- Update to 4.9.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions None seen among sites WPSec scans, 2026-10-22
- Attack surface
- PublishPress Permissions: Access Control, Content Permissions, User Access on WPSec AttackSurface
- Fix released
- Published
Description
The PublishPress Permissions plugin for WordPress is vulnerable to unauthorized modification of data in versions 3.7.1 up to, and including, 4.8.4. A variable name mismatch in the editableAssignmentIDs() function turned the per-role editability check for the 'roles_remove' AJAX action into a no-op, so every requested role assignment ID was accepted. This makes it possible for authenticated users who have been delegated the pp_manage_permissions capability, but are not user administrators, to remove supplemental role assignments from any user or group, including roles for post types they are not permitted to administer. By default only administrators hold this capability.
References
- https://wpsec.com/vuln/WPSEC-2026-0322/
- https://plugins.svn.wordpress.org/press-permit-core/tags/4.9.0/
- https://wordpress.org/plugins/press-permit-core/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS