High · published January 23, 2026
⚡ An authenticated user can elevate their privileges with just a sneaky click! The Melapress Role Editor plugin for WordPress has a misconfigured capability check that lets Subscribers become Administrators! 🔥 Think of it like a restaurant where the kitchen staff can suddenly declare themselves the head chef — they can now change the menu or even close the restaurant! This vulnerability allows attackers to assign themselves roles beyond what they should have access to, creating chaos. If exploited, an attacker could grant themselves full control over the WordPress site, compromising sensitive data, changing site settings, or even locking out legitimate admins. This could lead to an absolute disaster for your online presence, putting both your data and your users at risk!
Think of it like a restaurant where the kitchen staff can suddenly declare themselves the head chef — they can now change the menu or even close the restaurant! This vulnerability allows attackers to assign themselves roles beyond what they should have access to, creating chaos. The vulnerability stems from a misconfigured capability check in the 'save_secondary_roles_field' function, allowing users with Subscriber-level access to assign themselves higher roles, including Administrator, without proper authorization.
If exploited, an attacker could grant themselves full control over the WordPress site, compromising sensitive data, changing site settings, or even locking out legitimate admins. This could lead to an absolute disaster for your online presence, putting both your data and your users at risk! Immediately update the Melapress Role Editor plugin to version 1.1.2 or later to fix this vulnerability. Additionally, review user roles and permissions to ensure no unauthorized changes have been made. Always keep plugins updated to their latest versions! You've got this! By taking action now, you can secure your site and keep those pesky privilege escalators at bay! 🛡️