CVE-2026-109900

Summary

The Melapress Role Editor plugin (versions through 1.3.0) incorrectly assigns user privileges, allowing a low-privileged user to escalate their permissions via social engineering or诱使 another user with higher privileges interact with a malicious link or interface. This violates the principle of least privilege and enables unauthorized access to sensitive administrative functions.

Exploitability

Exploitation requires user interaction (e.g., clicking a crafted link or submitting a form) due to CVSS UI:R, and the attacker must already possess a low-privileged account; no remote code execution or direct network-based vector is indicated.

Blast radius

If exploited, an attacker could gain full administrative control over the WordPress instance, compromising all site data, users, and potentially enabling lateral movement if the host is part of a broader infrastructure.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Melapress Role Editor version 1.3.1 or later, as this version contains the vendor-provided fix for the privilege assignment flaw.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.