Description
WordPress Plugin PublishPress Capabilities-User Role Access, Editor Permissions, Admin Menus is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently update arbitrary plugin options. WordPress Plugin PublishPress Capabilities-User Role Access, Editor Permissions, Admin Menus version 2.3 is vulnerable; prior versions may also be affected.
Remediation
Update to plugin version 2.3.1 or latest
References
https://www.wordfence.com/blog/2021/12/massive-wordpress-attack-campaign/
https://plugins.svn.wordpress.org/capability-manager-enhanced/trunk/readme.txt
Related Vulnerabilities
WordPress Plugin Husker Portfolio Cross-Site Request Forgery (0.3)
WordPress Plugin Anti-Malware Security and Brute-Force Firewall Cross-Site Scripting (1.2.05.20)
WordPress Plugin AnyFont Cross-Site Scripting (2.2.3)
WordPress Plugin WP Statistics Cross-Site Scripting (13.0.9)
WordPress Plugin GD Star Rating Multiple Vulnerabilities (1.9.22)