CVE-2026-77003 Content Mask 1.8.0 - 1.8.5.4 - Contributor Publish Capability Bypass via create_new_content_mask
Contributors can bypass publish restrictions to publish posts and pages without proper authorization in the Content Mask WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77003?
CVE-2026-77003 is a low-severity vulnerability in Unknown Content Mask, published on 23 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability.
Weakness: CWE-269
Which versions are affected by CVE-2026-77003?
How do I fix CVE-2026-77003?
No fix has been published for CVE-2026-77003 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-77003 being exploited?
There is no known exploitation of CVE-2026-77003 in the wild and no public exploit code.
Sources
Also known as GHSA-mfj2-2xr8-6w24.