Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation. This issue affects PublishPress Capabilities: from n/a through 2.45.0. The flaw is classified under CWE-266 and would enable escalation from an editor role to higher privileges, potentially allowing an attacker to modify site content, alter settings, or manage capabilities beyond the intended editor permissions.

WordPress sites that use the PublishPress Capabilities plugin, with versions 2.45.0 or earlier. The issue is not present in versions 2.50.0 and later.

The CVSS score of 7.2 indicates a high‑risk condition, although the EPSS score is not available and the issue is not listed in the CISA KEV catalog. The attack vector is inferred to be local via the web interface, requiring the attacker to have an editor‑level account to exploit the privilege escalation. Due to the lack of publicly confirmed exploitation data, the likelihood remains uncertain, but the potential impact justifies immediate remediation.