CVE-2026-9842

HighCVSS 7.5/10Last modified Jul 8, 2026

Description

The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the `manage_options` capability to the `backstage_customizer_user` demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as `default_role`, leading to privilege escalation.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published
Jul 8, 2026
Last modified
Jul 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-98420In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbd_session_registerCVE-2026-98421In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonCVE-2026-98422In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown On ifup, CVE-2026-98423In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping TheCVE-2026-98424In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: undo netns switch if renaming the wiphy fails Once allCVE-2026-98425In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't warn when an IBSS has no channel to scan ieee802CVE-2026-98426In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifCVE-2026-98427In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel cCVE-2026-98428In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs eCVE-2026-98429In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep EQ resources alive while IRQ is registered The completiCVE-2026-98438.1The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient CVE-2026-98430In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The manageme
CVE-2026-9842: High severity, CVSS 7.5 | Vulnix