Security Alert Summary
The Content Mask plugin (versions before 1.8.5.5) fails to check the capability required to publish the post type being created. As a result, users with a role as low as Contributor can publish posts and pages without having the publish capability.
CVE Details
- CVE ID:
CVE-2026-77003 - Affected component: Content Mask WordPress plugin
- Affected versions: Versions prior to 1.8.5.5 (example entry: 1.8.0 listed as affected)
- Published: August 23, 2026 at 6:17 AM UTC
- Last modified: August 23, 2026 at 4:16 PM UTC
- CVSS v3.1: Base Score 2.7 – LOW
- Vector string:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction:
- Privileges Required: HIGH
- User Interaction: NONE
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Primary impact:
- Confidentiality: NONE
- Integrity: LOW (unauthorized content publication)
- Availability: NONE
- CWE / weakness: CWE-269 (Improper Privilege Management)
Technical Details
The plugin does not verify the capability required to publish the post type being created. In practice, this missing capability check allows accounts with a Contributor role to create content that becomes published even though Contributors normally lack the publish capability. The description identifies the lack of a proper capability check as the root cause; no specific function names or REST endpoints are provided in the available data.
Impact is limited to integrity of content: an attacker or a low-privilege user with Contributor-level access can publish posts and pages without higher privileges. There is no indication in the provided information of confidentiality or availability effects beyond content integrity.
How This Could Impact Your Website
Consider a site with a site owner, several internal staff users, and an external contractor who contributes content. If the contractor or a staff member is assigned the Contributor role, they could publish posts or pages directly without review. This could result in unintended public content, incorrect or misleading pages going live, or staged content being visible prematurely.
Practical consequences include exposure of internal processes through published drafts or author-byline information, and an increased risk of targeted phishing or social engineering if public content reveals internal names or roles. If you
re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for Contributor-level accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and published content for unusual or unexpected changes.
If you
like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
