CVE Watch6 oct 2026

CVE-2026-48197

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalati

CVSS

7.2

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 6 oct 2026 · Última mod.: 6 oct 2026 · CWE-266

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0.

Referencias oficiales

patchstack.comhttps://patchstack.com/database/wordpress/plugin/capability-manager-enhanced/vulnerability/wordpress-publishpress-capabilities-plugin-2-45-0-privilege-escalation-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-955948.1 ALT

—

———Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.0 versions.6h CVE-2026-397758.8 ALT

—

———Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions.6h CVE-2026-397748.8 ALT

—

———Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions.6h CVE-2026-3977310.0 CRÍ

—

———Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions.6h CVE-2026-397657.2 ALT

—

———Shop Manager Privilege Escalation in Challan <= 3.7.88 versions.6h CVE-2026-397619.8 CRÍ

—

———Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions.6h