The PublishPress Capabilities plugin suffers from an incorrect privilege assignment flaw that permits an attacker to gain elevated permissions on a WordPress site. This weakness, classified as CWE-266, allows a malicious actor to obtain new roles or capabilities beyond those they originally possessed, potentially compromising sensitive data or site functionality.

All installations of the PublishPress Capabilities plugin up to and including version 2.45.0, regardless of release date, are affected. Sites running later versions are not impacted.

The vulnerability has a CVSS score of 7.2, indicating a high severity, and an EPSS score of 0.00462 (indicating a very low exploitation probability). It is also not listed in the CISA KEV catalog. Though the exact attack path is not detailed in the description, the plugin’s nature implies that a user able to manipulate its settings or submit data could invoke the flawed privilege assignment logic, which is an inference from the context. Given the elevated permissions achievable, the potential impact spans confidentiality, integrity, and availability on affected WordPress sites.