WordPress Plugin Vulnerabilities

PublishPress Capabilities < 2.32.0 - Missing Authorization

Description

The PublishPress Capabilities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.31.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
capability-manager-enhanced
Fixed in 2.32.0

References

CVE
CVE-2026-32394
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/04cd7528-65af-4280-a683-ffedf66a6940

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Nabil Irawan
Verified
No
WPVDB ID
60efe96f-1f30-4fd6-9403-bca436a74b45

Timeline

Publicly Published
2026-02-20 (about 2 months ago)
Added
2026-04-15 (about 27 days ago)
Last Updated
2026-04-15 (about 27 days ago)

Other

Published
Title
Published
2026-01-14
Title
Simple GDPR Cookie Compliance < 2.0.1 - Missing Authorization
Published
2026-02-23
Title
Author Avatars List/Block <= 2.1.25 - Missing Authorization
Published
2026-04-15
Title
Riaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action
Published
2026-01-06
Title
The Events Calendar Countdown Addon < 1.4.16 - Missing Authorization
Published
2025-03-27
Title
Tickera < 3.5.5.3 - Missing Authorization