Privilege Escalation in Melapress Role Editor Plugin for WordPress

CVE-2025-14866

What is CVE-2025-14866?

The Melapress Role Editor plugin for WordPress contains a significant vulnerability that arises from a misconfigured capability check in its 'save_secondary_roles_field' function. This flaw enables authenticated attackers with Subscriber-level access or higher to exploit the system by assigning themselves additional roles, including that of an Administrator, thereby compromising the security and integrity of the WordPress environment.

References