home / blog
2026-11-08 · critical
CVE-2026-109900: Privilege Escalation in Melapress Role Editor
Critical privilege escalation in Melapress Role Editor ≤1.3.0. CVSS 9.6. Patch not available at this moment.
CVE-2026-109900 identifies an Incorrect Privilege Assignment flaw in the WordPress plugin Melapress Role Editor, versions up to 1.3.0. The vulnerability enables privilege escalation, allowing an attacker to elevate their privileges on sites using it. WordPress sites running this plugin are immediately at risk.
The vulnerability scores 9.6 on the CVSS scale, classified as critical. It was published on 2026-11-08. According to public signals tracked on X, no official patch is yet available. The absence of a confirmed public exploit does not reduce criticality: the flaw is accessible and well-documented in the CVE registry.
If the plugin is installed on your systems, take immediate action. Check the current version. If it is 1.3.0 or lower, disable and remove the plugin until Melapress releases a patch. Monitor Melapress official advisories and security channels. Review access logs for suspicious activity that might indicate exploitation of this flaw.
At a glance
- What
- Incorrect Privilege Assignment vulnerability in the WordPress plugin Melapress Role Editor enabling privilege escalation. Affects versions up to 1.3.0.
- Severity
- Critical (CVSS 9.6). Allows an attacker to elevate their privileges on WordPress sites using the plugin.
- Affected versions
- Melapress Role Editor: from initial version through 1.3.0 inclusive.
- Fix
- Not reported in CVE. Consult official Melapress advisories for available patches.
- Status
- CVE published on 2026-11-08. According to public signals, patch is not yet available.
- Action
- Verify if the plugin is installed. Disable or remove Melapress Role Editor until a patch is available. Monitor official Melapress changelogs.
Sources: NVD, CVE-2026-109900