CVE-2026-109900: Privilege Escalation in Melapress Role Editor
CVE-2026-109900 is an incorrect privilege assignment vulnerability in the Melapress Role Editor WordPress plugin (melapress-role-editor). The NVD record, published 2026-11-08, says the issue allows privilege escalation and affects the plugin from n/a through 1.3.0. It is rated CVSS 9.6.
Role-management plugins sit at a sensitive point in WordPress: they control which capabilities each user role holds. A flaw that assigns privileges incorrectly can let a low-privileged account gain administrative abilities.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-109900 |
| CVSS Score | 9.6 (Critical) |
| Weakness | Incorrect Privilege Assignment |
| Affected Plugin | Melapress Role Editor (melapress-role-editor) |
| Affected Versions | Through 1.3.0 |
| Impact | Privilege escalation |
| Published | 2026-11-08 |
| Source | NIST NVD |
The NVD entry does not specify the authentication level required or a fixed version, and no exploitation in the wild has been reported.
Remediation
- Check the installed version of the plugin and update to the latest release as soon as the vendor publishes a fix newer than 1.3.0.
- If no fixed release is available, deactivate the plugin until one is.
- Audit user accounts and roles for unexpected administrators or capability changes.
# List installed version
wp plugin get melapress-role-editor --field=version
# Review administrators and recent role changes
wp user list --role=administrator --format=table
wp role list- Review recent registrations and rotate credentials for any account that looks suspicious.
- Enforce least privilege and MFA on all administrator accounts.
Key Takeaways
- CVE-2026-109900 is a CVSS 9.6 privilege escalation in Melapress Role Editor through 1.3.0.
- Sites using the plugin should update or deactivate it and audit roles and administrators.
- Public details are limited, so monitor the vendor and NVD entries for updates.