High · 8.1 CVE-2026-94487 EUVD-2026-85480GHSA-4wfx-q57g-47xc

WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

Published Sep 23, 2026 · Updated Sep 23, 2026 · Assigned by Patchstack

Vendor: publishpress Product: PublishPress Capabilities

Description

Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.

Affected products

Vendor	Product	Affected	Fixed
PublishPress	PublishPress Capabilities	≤ 2.50.1	—

References

https://patchstack.com/database/wordpress/plugin/capability-manager-enhanced/vulnerability/wordpress-publishpress-capabilities-plugin-2-50-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve vdb-entry