CVE WatchOct 6, 2026

CVE-2026-48197

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalati

CVSS

7.2

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Oct 6, 2026 · Last modified: Oct 6, 2026 · CWE-266

EPSS · 30d

Not enough EPSS history yet.

Technical description

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

Official references

patchstack.comhttps://patchstack.com/database/wordpress/plugin/capability-manager-enhanced/vulnerability/wordpress-publishpress-capabilities-plugin-2-45-0-privilege-escalation-vulnerability?_s_id=cve

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-955948.1 HIG

—

———Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.0 versions.7h CVE-2026-397758.8 HIG

—

———Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.7h CVE-2026-397748.8 HIG

—

———Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.7h CVE-2026-3977310.0 CRI

—

———Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.7h CVE-2026-397657.2 HIG

—

———Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.7h CVE-2026-397619.8 CRI

—

———Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.7h