The Melapress Role Editor plugin for WordPress contains a missing authorization flaw (CWE-862) that allows an attacker to modify user roles without proper access control. This broken access control lets an unauthorized or poorly privileged user gain elevated privileges, potentially enabling them to assume administrative rights or perform other high‑impact actions. The vulnerability carries a CVSS score of 7.1, indicating high severity.

WordPress sites that have the Melapress Role Editor plugin installed at version 1.3.0 or older are affected. The issue impacts all versions from the earliest released up to and including 1.3.0 and appears to affect the default configuration of the plugin. No other product or version information is provided.

The CVSS score of 7.1 signals a serious risk, but the EPSS score is not available, so the current probability of exploitation is unknown. The likely attack vector is a remote web request to the plugin’s role‑editing interface that does not enforce proper role checks, which is inferred based on the plugin’s exposed functionality. The vulnerability is not listed in the CISA KEV catalog, suggesting that no large‑scale exploitation campaigns are known at this time. Nonetheless, an attacker who can authenticate to the WordPress site could leverage this flaw to elevate privileges and compromise site integrity.