{"id":"CVE-2026-109899","kind":"vulnerability","aliases":["CVE-2026-109899"],"related":[],"title":"Melapress Role Editor: missing authorization lets users change access control","description":"Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.","summary":"Melapress Role Editor, a WordPress plugin for managing user roles, has a missing authorization check in versions through 1.3.0. The sources say an attacker can exploit incorrectly configured access control levels to gain permissions they should not have.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"melapress-role-editor","fixed":[],"affected":"<= 1.3.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["authenticated","melapress-role-editor","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"WordPress admin > Plugins: if Melapress Role Editor (melapress-role-editor) is 1.3.0 or earlier, treat as exposed. CLI: wp plugin get melapress-role-editor --field=version. Check Patchstack's database page for the plugin for a patched version.","fix":null,"status":"open","published_at":"2026-11-08T16:16:36+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","triaged_at":"2026-11-08T16:18:50+00:00","updated_at":"2026-11-08T16:19:39+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-08T16:18:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Melapress Role Editor: missing authorization lets users change access control","impact":"medium","summary":"Melapress Role Editor, a WordPress plugin for managing user roles, has a missing authorization check in versions through 1.3.0. The sources say an attacker can exploit incorrectly configured access control levels to gain permissions they should not have.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","melapress-role-editor"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users gain role or access control permissions","analyst_note":"Check the NVD entry and the Melapress advisory for the fixed version, required auth, and the specific configuration that is exposed.","how_to_check":"- Check the installed version of the Melapress Role Editor plugin (melapress-role-editor) in the WordPress admin plugins page.\n- Confirm whether the installed version is `1.3.0` or earlier.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Melapress Role Editor WordPress plugin at version 1.3.0 or earlier are in scope according to the NVD entry. The sources do not say which configurations are exposed beyond the access control misconfiguration described.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000712,"input_tokens":4544,"output_tokens":515,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Melapress advisory for the fixed version, required auth, and the specific configuration that is exposed.","search":"'-109899':13A,16A '-2026':12A,15A '1.3.0':46B,90C 'access':9A,56B,78C 'affect':83C 'allow':74C 'attack':51B 'authent':21B 'author':5A,41B,63C 'chang':8A 'check':42B 'configur':55B,77C 'control':10A,57B,79C 'cve':11A,14A 'editor':3A,20A,25B,30B,69C,73C,86C 'exploit':53B,75C 'gain':60B 'incorrect':54B,76C 'issu':82C 'let':6A 'level':58B 'levels.this':81C 'manag':35B 'melapress':1A,18A,23B,28B,66C,67C,71C,84C 'melapress-role-editor':17A,22B,70C 'miss':4A,40B,62C 'n/a':88C 'packag':26B 'permiss':61B 'plugin':33B 'role':2A,19A,24B,29B,37B,68C,72C,85C 'say':49B 'secur':80C 'sourc':48B 'user':7A,36B 'version':44B 'vulner':64C 'wordpress':27B,32B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Melapress Role Editor plugin at 1.3.0 or earlier. NVD/Patchstack describe a missing authorization check (CVSS 7.1, needs a logged-in low-privilege account, network reachable). Sites without the plugin can skip it. The exact exposed function is not stated in the sources I could read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["melapressroleeditor"],"ptokens":["editor","melapress","role"],"labels":["authenticated","high","melapressroleeditor","package","wordpress"],"campaign_type":null,"search_a":"'-109899':13A,16A '-2026':12A,15A 'access':9A 'author':5A 'chang':8A 'control':10A 'cve':11A,14A 'editor':3A,20A 'let':6A 'melapress':1A,18A 'melapress-role-editor':17A 'miss':4A 'role':2A,19A 'user':7A","search_b":"'1.3.0':46B 'access':56B 'attack':51B 'authent':21B 'author':41B 'check':42B 'configur':55B 'control':57B 'editor':25B,30B 'exploit':53B 'gain':60B 'incorrect':54B 'level':58B 'manag':35B 'melapress':23B,28B 'melapress-role-editor':22B 'miss':40B 'packag':26B 'permiss':61B 'plugin':33B 'role':24B,29B,37B 'say':49B 'sourc':48B 'user':36B 'version':44B 'wordpress':27B,32B","search_c":"'1.3.0':90C 'access':78C 'affect':83C 'allow':74C 'author':63C 'configur':77C 'control':79C 'editor':69C,73C,86C 'exploit':75C 'incorrect':76C 'issu':82C 'levels.this':81C 'melapress':66C,67C,71C,84C 'melapress-role-editor':70C 'miss':62C 'n/a':88C 'role':68C,72C,85C 'secur':80C 'vulner':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T16:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109899","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109899","severity":null,"published_at":"2026-11-08T16:16:36+00:00","modified_at":"2026-11-08T16:16:36+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","fetched_at":"2026-11-08T16:18:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109899:2191","url":"https://wordpress.org/plugins/melapress-role-editor/","severity":null,"published_at":"2026-11-08T16:19:39+00:00","modified_at":"2026-11-08T16:19:39+00:00","first_seen_at":"2026-11-08T16:19:39+00:00","fetched_at":"2026-11-08T16:19:39+00:00","note":"NVD says through 1.3.0. WordPress.org changelog's latest listed release is 1.3.0 (2026-06-09), with no later fix noted; Patchstack lists a new Broken Access Control <= 1.3.0 entry 2 days ago, but I could not read its patched version. Fix unknown; settle by reading the Patchstack entry or the plugin's SVN changelog. Not exploited, no PoC found. Nothing verified.","cites":["https://wordpress.org/plugins/melapress-role-editor/","https://patchstack.com/database/wordpress/plugin/melapress-role-editor"]}],"documents":[{"id":102482,"url":"https://wordpress.org/plugins/melapress-role-editor/","title":"Melapress Role Editor – WordPress.org (changelog)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":102483,"url":"https://patchstack.com/database/wordpress/plugin/melapress-role-editor","title":"Patchstack: Melapress Role Editor vulnerability history","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}