PublishPress Capabilities < 2.50.1 - Editor+ Privilege Escalation via Default Capability Grant

Description

The plugin is vulnerable to Privilege Escalation due to the addPluginCapabilities() function unconditionally granting the Editor role all 15 manage_capabilities_* capabilities — including manage_capabilities, manage_capabilities_roles, manage_capabilities_settings, and manage_capabilities_backup — via a hard-coded $eligible_roles = ['administrator', 'editor'] assignment that runs automatically on the first admin_init after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with cme_, capsman, pp_capabilities, or presspermit via update_option(). The escalation stops short of full Administrator access, as WordPress's map_meta_cap layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on manage_capabilities_* capabilities remains fully accessible.