Skip to content
OpenAdvisories
Medium · 4.3 CVE-2026-32394 EUVD-2026-11907GHSA-w9p9-xcrg-c8jv

WordPress PublishPress Capabilities plugin <= 2.31.0 - Broken Access Control vulnerability

Published Mar 13, 2026 · Updated Apr 29, 2026 · Assigned by Patchstack

Vendor: publishpress Product: PublishPress Capabilities

Description

Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Capabilities: from n/a through <= 2.31.0.

Affected products

VendorProductAffectedFixed
PublishPress PublishPress Capabilities ≤ 2.31.0 —

References