CVE-2025-14866: Melapress Role Editor <= 1.1.1 - Improper Authorization to Authenticated (Subscriber+) Privilege Escalation via Secondary Role Assignment
The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigured capability check on the 'save_secondary_roles_field' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to assign themselves additional roles including Administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-14866?
CVE-2025-14866 is considered a critical vulnerability due to the potential for privilege escalation.
How do I fix CVE-2025-14866?
To mitigate CVE-2025-14866, update the Melapress Role Editor plugin to the latest version beyond 1.1.1.
What versions are affected by CVE-2025-14866?
CVE-2025-14866 affects all versions of Melapress Role Editor up to and including 1.1.1.
Can CVE-2025-14866 be exploited by unauthenticated users?
CVE-2025-14866 requires authentication as a Subscriber+ to exploit the privilege escalation.
What kind of attack does CVE-2025-14866 enable?
CVE-2025-14866 enables authenticated users to improperly elevate their privileges within the WordPress site.