← CVE Intelligence

CVE-2026-77003

Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask PUBLISHED

Description (CNA)

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability.

Affected (CNA)

Vendor / productVersions
Unknown / Content Maskaffected 1.8.0 before 1.8.5.5

CWE

No CWE identifiers supplied.

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.