Description

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-08-23T06:17:23.720Z",
  "pubdate": "2026-08-23T06:17:23.720Z",
  "executiveSummary": "An authorization bypass vulnerability exists in the Content Mask WordPress plugin prior to version 1.8.5.5, characterized by insufficient capability checks during post creation and publishing processes.\nThe vulnerability allows low-privileged authenticated users, specifically those assigned the Contributor role, to bypass standard WordPress access control mechanisms and successfully publish arbitrary posts and pages without holding the requisite publishing capabilities.\nThe affected product is the Content Mask WordPress plugin for versions under 1.8.5.5, which fails to properly validate user roles and permissions against the target post type requirements.\nThe risk implications include unauthorized content publication, potential content defacement, unauthorized injection of malicious links or SEO spam, and escalation of content publication privileges within the WordPress environment.\nAn attacker must possess authenticated access to the target WordPress installation with a low-privileged role such as Contributor to exploit this security flaw.\nExploitation requirements include network access to the WordPress administrative interface or AJAX endpoints and an active user session with Contributor-level privileges or higher, absent the specific publish capability.",
  "technicalDetails": "The root cause of the vulnerability stems from improper access control enforcement within the Content Mask plugin's request handling logic.\nSpecifically, the plugin fails to perform rigorous capability checks to verify whether the authenticated user possesses the specific capability required to publish the specific post type being created.\nIn the default WordPress architecture, users assigned the Contributor role are restricted to creating and editing draft posts, lacking the capability to publish them directly.\nWhen interacting with the vulnerable functionality in the Content Mask plugin before version 1.8.5.5, the underlying code processes post creation and publishing actions without adequately validating the current user's capabilities against the target post type's publication requirements.\nThe attack flow proceeds as follows: First, an authenticated attacker with a Contributor role initiates a request to create or submit a post or page utilizing the vulnerable plugin functionality. Second, the plugin processes the request and interacts with the WordPress database to update the post status. Third, because the vulnerable component omits the necessary capability verification (such as checking for 'publish_posts' or equivalent custom post type publish capabilities), the system honors the request and transitions the post status from draft to published.\nThe vulnerable component is the permission validation logic embedded within the Content Mask plugin handling post creation workflows for affected versions prior to 1.8.5.5.\nAuthentication is required to exploit this flaw, as the attacker must hold at least a Contributor-level account on the target WordPress site.\nPrivilege requirements are minimal, limited to low-privileged roles that natively lack publishing rights.\nThe network exposure is standard HTTP/HTTPS exposure applicable to WordPress web applications accessible via the internet or internal networks.\nThe post-exploitation impact includes the unauthorized publishing of content, allowing malicious actors or untrusted users to bypass editorial review workflows, publish arbitrary pages or posts, distribute spam, or propagate malicious external links directly on the live site."
}