The Melapress Role Editor plugin for WordPress is vulnerable because the function responsible for saving secondary roles performs an incorrect capability check. An authenticated user with a Subscriber role or higher can exploit this flaw to assign themselves additional roles, including Administrator. This elevation of privilege allows the attacker to execute any action available to an Administrator, compromising the confidentiality, integrity, and availability of the entire WordPress site. The flaw is categorized as a weak authority check, corresponding to CWE-863.

All installations of the Melapress Role Editor plugin running versions 1.1.1 or earlier are vulnerable. Any WordPress site that has installed or downloaded the plugin in these or earlier releases is affected.

The CVSS base score of 8.8 indicates high severity. The EPSS score is less than 1 %, suggesting that actual exploitation attempts are currently rare or undocumented. The vulnerability is not listed in the CISA KEV catalog. Because the flaw requires the attacker to be authenticated, the attack vector is local to the WordPress admin interface; an attacker can trigger the escalation simply by accessing the secondary role assignment UI from their account.