CVE-2025-14866

The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigured capability check on the 'save_secondary_roles_field' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to assign themselves additional roles including Administrator.

• CWE-863

• https://plugins.trac.wordpress.org/browser/melapress-role-editor/tags/1.1.0/classes/admin/additional-form-fields/class-user-profile.php#L103
• https://plugins.trac.wordpress.org/browser/melapress-role-editor/tags/1.1.0/classes/admin/ajax/class-admin-ajax.php
• https://plugins.trac.wordpress.org/changeset/3439348/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/0509aaf1-8aae-42e5-84d3-ea9b431703f3?source=cve

Published

Jan 23, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-14859The Semtech LR11xx LoRa transceivers implement secure boot f…7
• CVE-2025-1486The WoWPth WordPress plugin through 2.0 does not sanitise an…7.1
• CVE-2025-14860Use-after-free in the Disability Access APIs component. This…9.8
• CVE-2025-14861Memory safety bugs present in Firefox 146. Some of these bug…8.8
• CVE-2025-14864The Virusdie - One-click website security plugin for WordPre…4.3
• CVE-2025-14865The Passster – Password Protect Pages and Content plugin for…6.4
• CVE-2025-14867The Flashcard plugin for WordPress is vulnerable to Path Tra…6.5
• CVE-2025-14868The Career Section plugin for WordPress is vulnerable to Cro…8.8
• CVE-2025-14869GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
• CVE-2025-1487The WoWPth WordPress plugin through 2.0 does not sanitise an…7.1
• CVE-2025-14870GitLab has remediated an issue in GitLab CE/EE affecting all…7.5
• CVE-2025-14873The LatePoint – Calendar Booking Plugin for Appointments and…4.3