CVE-2026-77003
Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability.
| Vendor | unknown |
| Product | content mask |
| Published | Aug 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown content mask
Be the first to know when new unknown vulnerabilities affecting unknown content mask are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Content Mask
1.8.0 < 1.8.5.5
References
Credits
Pablo González and Fran Ramírez WPScan