CVE-2026-32394
Missing Authorization in PublishPress Capabilities Allows Privilege Escalation
Publication date: 2026-03-13
Last updated on: 2026-04-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| publishpress | capabilities | to 2.31.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-32394 is a broken access control vulnerability in the WordPress PublishPress Capabilities Plugin versions up to and including 2.31.0.
This vulnerability arises from missing authorization, authentication, or nonce token checks within certain functions, which allows unprivileged users to perform actions that should be reserved for higher-privileged roles.
It is classified under the OWASP Top 10 category A1: Broken Access Control.
How can this vulnerability impact me? :
The vulnerability allows users with only subscriber-level privileges to perform actions that require higher privileges, potentially leading to unauthorized changes or access within the PublishPress Capabilities plugin.
However, the impact is considered low severity with a CVSS score of 4.3, and it is unlikely to be exploited in a significant manner.
Users are advised to update to version 2.32.0 or later to mitigate this risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability involves missing authorization checks in the PublishPress Capabilities plugin, allowing unprivileged users to perform restricted actions.'}, {'type': 'paragraph', 'content': 'Detection would typically involve checking the version of the PublishPress Capabilities plugin installed on your WordPress system to see if it is version 2.31.0 or earlier, as these versions are vulnerable.'}, {'type': 'paragraph', 'content': 'You can detect the plugin version by running commands on your server such as:'}, {'type': 'list_item', 'content': 'Using WP-CLI: `wp plugin list | grep publishpress-capabilities`'}, {'type': 'list_item', 'content': 'Checking the plugin\'s readme or main plugin file for the version number, e.g., `cat wp-content/plugins/capability-manager-enhanced/readme.txt | grep "Stable tag"`'}, {'type': 'list_item', 'content': 'Reviewing WordPress admin dashboard plugin page for the installed version.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is related to broken access control, monitoring logs for unauthorized privilege escalation attempts or unusual actions by subscriber-level users may also help detect exploitation attempts.'}] [1]
What immediate steps should I take to mitigate this vulnerability?
The primary and immediate mitigation step is to update the PublishPress Capabilities plugin to version 2.32.0 or later, where the vulnerability has been patched.
If updating immediately is not possible, consider restricting subscriber-level user capabilities temporarily to limit potential exploitation.
Additionally, enable automated updates for plugins if supported, such as those offered by Patchstack, to ensure rapid protection against this and other vulnerabilities.
Regularly monitor your WordPress logs for suspicious activity related to privilege escalation.