CVE-2026-109899

HighCVSS 7.1

Published: 08/11/2026(UTC)Updated: 08/11/2026(UTC)Translated: 08/11/2026(UTC)NVD NIST

Summary

The Melapress Role Editor plugin for WordPress (through version 1.3.0) has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. An unauthorized user can perform operations they should not be permitted to do.

Risk Assessment

Missing authorization may allow an attacker to change roles and permissions on the site without proper rights. This can lead to access escalation and takeover of the site.

Recommendation

Update Melapress Role Editor to a version later than 1.3.0 or disable it. Verify access control configuration and check for unauthorized permission changes.

Other vulnerabilities in Melapress Role Editor

CVE-2026-109900Critical
The Melapress Role Editor plugin for WordPress (through version 1.3.0) contains an incorrect privilege assignment vulnerability that allows privilege escalation. A low-privileged user can gain a higher level of access within the system.

Original NVD description (English source)

Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS