The Content Mask WordPress plugin, in versions 1.8.0 through 1.8.5.4, fails to verify that a user has the capability to publish the post type created by the create_new_content_mask function. As a result, a user with the Contributor role—which normally does not hold publish rights—can publish posts and pages on the site. This deficiency permits an unauthorized user to inject new content, thereby undermining the site’s integrity and potentially spreading spam or malicious material.

WordPress sites using the Content Mask plugin with any version prior to 1.8.5.5, specifically 1.8.0 to 1.8.5.4, are affected. The vendor is listed as Unspecified:Content Mask. No public patch has been cited for earlier releases, but 1.8.5.5 contains the fix.

The vulnerability does not provide a CVSS score or an EPSS score; it is not listed in CISA’s KEV catalog. Nevertheless, because the flaw allows any authenticated Contributor to publish content, the attack vector is likely the normal WordPress post creation interface or API endpoints. The exploitation requires only the ability to access the plugin’s create_new_content_mask function, which is readily available to logged‑in users with that role.