{"id":"CVE-2026-109900","published":"2026-11-08T16:16:36.773","lastModified":"2026-11-08T19:17:33.233","description":"Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: from n/a through 1.3.0.","cvssScore":9.6,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cwes":["CWE-266"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/melapress-role-editor/vulnerability/wordpress-melapress-role-editor-plugin-1-3-0-privilege-escalation-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Melapress Role Editor plugin (versions through 1.3.0) incorrectly assigns user privileges, allowing a low-privileged user to escalate their permissions via social engineering or诱使 another user with higher privileges interact with a malicious link or interface. This violates the principle of least privilege and enables unauthorized access to sensitive administrative functions.","exploitability":"Exploitation requires user interaction (e.g., clicking a crafted link or submitting a form) due to CVSS UI:R, and the attacker must already possess a low-privileged account; no remote code execution or direct network-based vector is indicated.","blast_radius":"If exploited, an attacker could gain full administrative control over the WordPress instance, compromising all site data, users, and potentially enabling lateral movement if the host is part of a broader infrastructure.","remediation":"Upgrade to Melapress Role Editor version 1.3.1 or later, as this version contains the vendor-provided fix for the privilege assignment flaw.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["privilege-escalation","wordpress-plugin","social-engineering","cwe-266"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:44:38.354Z"}}