CVE-2026-75927

{
  "etk_id": "ETK-2026-1901",
  "cve_id": "CVE-2026-75927",
  "display_id": "CVE-2026-75927",
  "ghsa_id": "GHSA-pv68-4cpj-v6j3",
  "euvd_id": "EUVD-2026-74758",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Privilege escalation in PublishPress Capabilities",
  "summary": "PublishPress Capabilities versions through 2.50.0 can assign elevated plugin management permissions to the WordPress Editor role after activation. An authenticated Editor can then alter non-administrator roles and plugin settings; administrator-level access is not established by the evidence.",
  "mitigation": "Until a corrected release is available, disable the plugin on affected sites or remove its management permissions from the Editor role. Review Editor assignments, role permissions, and relevant plugin settings for unauthorized changes.",
  "vendor": "publishpress",
  "product": "User Role Editor – PublishPress Capabilities: Access Control and User Roles",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.50.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "User Role Editor – PublishPress Capabilities: Access Control and User Roles",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.2,
  "cvss_src": "other",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0064,
  "epss_percentile": 0.4969,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 33.71041351666667,
  "t0_at": "2026-09-09T07:40:56.043000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-17T19:23:52.020030+00:00",
      "days": 38.48814788229166,
      "is_lower_bound": false,
      "measured_at": "2026-09-09T07:40:56.043000+00:00",
      "url": null
    },
    "kev": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 34,
      "is_lower_bound": false,
      "measured_at": "2026-09-09T07:40:56.043000+00:00",
      "precision": "day",
      "url": "https://vulncheck.com/cve/CVE-2026-75927"
    },
    "trigger_signal": {
      "at": "2026-10-13T00:00:00+00:00",
      "days": 33.67990690972222,
      "is_lower_bound": false,
      "measured_at": "2026-09-09T07:40:56.043000+00:00",
      "url": "https://vulncheck.com/cve/CVE-2026-75927"
    }
  }
}