{"id":"CVE-2026-109900","kind":"vulnerability","aliases":["CVE-2026-109900"],"related":[],"title":"Melapress Role Editor: flaw lets users escalate their own privileges","description":"Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: from n/a through 1.3.0.","summary":"The Melapress Role Editor WordPress plugin assigns privileges incorrectly, letting a user gain higher access than intended. An attacker who gets into a low-privilege account can raise their own role to a more powerful one.","severity":"critical","cvss":9.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"melapress-role-editor","fixed":[],"affected":"<= 1.3.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["melapress-role-editor","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"In WordPress admin go to Plugins and check the Melapress Role Editor version, or run: wp plugin get melapress-role-editor --field=version. 1.3.0 or earlier is in the affected range. No patched release is confirmed; check wordpress.org/plugins/melapress-role-editor for a version newer than 1.3.0.","fix":null,"status":"open","published_at":"2026-11-08T16:16:36+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","triaged_at":"2026-11-08T16:18:50+00:00","updated_at":"2026-11-08T16:19:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T16:18:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Melapress Role Editor: flaw lets users escalate their own privileges","impact":"high","summary":"The Melapress Role Editor WordPress plugin assigns privileges incorrectly, letting a user gain higher access than intended. An attacker who gets into a low-privilege account can raise their own role to a more powerful one.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","melapress-role-editor","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"low-privilege user gains administrator rights on the site","analyst_note":"Confirm the fixed version and vendor advisory for Melapress Role Editor; the NVD entry gives no fixed version.","how_to_check":"- Look for the `melapress-role-editor` plugin in the WordPress admin under Plugins and note its version\n- Check whether the installed version is `1.3.0` or earlier","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Melapress Role Editor WordPress plugin at version 1.3.0 or earlier are exposed. The sources do not say which configurations are affected or whether a patched release exists, so a site that uses the plugin should treat it as exposed until the vendor confirms a fix.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000712,"input_tokens":4537,"output_tokens":517,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and vendor advisory for Melapress Role Editor; the NVD entry gives no fixed version.","search":"'-109900':13A,16A '-2026':12A,15A '1.3.0':91C 'access':44B 'account':56B 'affect':84C 'allow':80C 'assign':36B,69C 'attack':48B 'cve':11A,14A 'editor':3A,20A,24B,33B,75C,79C,87C 'escal':7A 'escalation.this':82C 'flaw':4A 'gain':42B 'get':50B 'higher':43B 'host':28B 'incorrect':38B,67C 'intend':46B 'issu':83C 'let':5A,39B 'low':54B 'low-privileg':53B 'melapress':1A,18A,22B,31B,72C,73C,77C,85C 'melapress-role-editor':17A,21B,76C 'n/a':89C 'one':66B 'packag':25B 'plugin':35B 'power':65B 'privileg':10A,37B,55B,68C,81C 'rais':58B 'role':2A,19A,23B,32B,61B,74C,78C,86C 'self':27B 'self-host':26B 'user':6A,41B 'vulner':70C 'wordpress':29B,34B","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the Melapress Role Editor plugin at version 1.3.0 or earlier are affected, per the CVE/Patchstack range. 1.3.0 is the latest release on WordPress.org, so no fixed version is confirmed yet. Per the CVE text, a user with a low-privilege account could raise their own role; sites with open registration or many untrusted users matter most. Sites without the plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["melapressroleeditor"],"ptokens":["editor","melapress","role"],"labels":["critical","melapressroleeditor","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-109900':13A,16A '-2026':12A,15A 'cve':11A,14A 'editor':3A,20A 'escal':7A 'flaw':4A 'let':5A 'melapress':1A,18A 'melapress-role-editor':17A 'privileg':10A 'role':2A,19A 'user':6A","search_b":"'access':44B 'account':56B 'assign':36B 'attack':48B 'editor':24B,33B 'gain':42B 'get':50B 'higher':43B 'host':28B 'incorrect':38B 'intend':46B 'let':39B 'low':54B 'low-privileg':53B 'melapress':22B,31B 'melapress-role-editor':21B 'one':66B 'packag':25B 'plugin':35B 'power':65B 'privileg':37B,55B 'rais':58B 'role':23B,32B,61B 'self':27B 'self-host':26B 'user':41B 'wordpress':29B,34B","search_c":"'1.3.0':91C 'affect':84C 'allow':80C 'assign':69C 'editor':75C,79C,87C 'escalation.this':82C 'incorrect':67C 'issu':83C 'melapress':72C,73C,77C,85C 'melapress-role-editor':76C 'n/a':89C 'privileg':68C,81C 'role':74C,78C,86C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-08T16:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109900","severity":null,"published_at":"2026-11-08T16:16:36+00:00","modified_at":"2026-11-08T16:16:36+00:00","first_seen_at":"2026-11-08T16:18:34+00:00","fetched_at":"2026-11-08T16:18:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109900:2188","url":"https://wordpress.org/plugins/melapress-role-editor/","severity":null,"published_at":"2026-11-08T16:19:45+00:00","modified_at":"2026-11-08T16:19:45+00:00","first_seen_at":"2026-11-08T16:19:45+00:00","fetched_at":"2026-11-08T16:19:45+00:00","note":"Patchstack lists a Privilege Escalation entry <= 1.3.0 (2 days ago) for melapress-role-editor, but I found no patched version. WordPress.org shows 1.3.0 as latest (2026-06-09); its changelog has no security fix. Sibling CVE-2025-14866 (<=1.1.1, fixed 1.2.0) is a different issue. Fix unknown; the vendor has not said there is no fix, so I did not mark fix_status none or verify anything. Revisit for a release after 1.3.0 or the Patchstack entry page.","cites":["https://wordpress.org/plugins/melapress-role-editor/","https://patchstack.com/database/wordpress/plugin/melapress-role-editor"]}],"documents":[{"id":102482,"url":"https://wordpress.org/plugins/melapress-role-editor/","title":"Melapress Role Editor – WordPress.org (changelog)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":102483,"url":"https://patchstack.com/database/wordpress/plugin/melapress-role-editor","title":"Patchstack: Melapress Role Editor vulnerability history","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}