The Content Mask WordPress plugin, in versions 1.8.0 through 1.8.5.4, fails to verify that a user has the capability to publish the post type created by the create_new_content_mask function. As a result, a user with the Contributor role—which normally does not hold publish rights—can publish posts and pages on the site. This deficiency permits an unauthorized user to inject new content, thereby undermining the site’s integrity and potentially spreading spam or malicious material.

WordPress sites using the Content Mask plugin with any version prior to 1.8.5.5, specifically 1.8.0 to 1.8.5.4, are affected. The vendor is listed as Unknown:Content Mask. No public patch has been cited for earlier releases, but 1.8.5.5 contains the fix.

The vulnerability has a CVSS score of 2.7, an EPSS score of < 1%, and is not listed in CISA’s KEV catalog. Nevertheless, because the flaw allows any authenticated Contributor to publish content, the attack vector is likely the normal WordPress post creation interface or API endpoints. The exploitation requires only the ability to access the plugin’s create_new_content_mask function, which is readily available to logged-in users with that role.