CVE-2026-109899
Deferred Deferred - Pending Action

Missing Authorization in Melapress Role Editor

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: Patchstack

Description
Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-109899
EUVD
EUVD-2026-119612

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
melapress melapress_role_editor From 1.0 (inc) to 1.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-109899 is a Missing Authorization vulnerability in the Melapress Role Editor plugin for WordPress. It allows users with low-level privileges, such as Subscribers, to access restricted pages or perform unauthorized actions due to incorrectly configured access control security levels.

Detection Guidance

To detect this vulnerability, check the installed version of the Melapress Role Editor plugin. If the version is 1.3.0 or below, the system is vulnerable. Use commands like 'wp plugin list' in WordPress or inspect the plugin directory for version details.

Impact Analysis

This vulnerability could allow unauthorized users to view sensitive data of other users, such as personal information or restricted content. Attackers with low privileges might escalate their access to perform actions they shouldn't be able to, compromising the security of the WordPress site.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive user data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized access to personal or health data could result in legal penalties, data breach notifications, and reputational damage for organizations handling such data.

Mitigation Strategies

Immediately update the Melapress Role Editor plugin to version 1.4.0 or later. If updating is not possible, remove the plugin or restrict user roles to prevent unauthorized access until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109899. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...