CVE-2026-77003: Unknown Content Mask

Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days.

The Content Mask WordPress plugin before 1.8.5.5 does not check the capability required to publish the post type being created, allowing users with a role as low as Contributor to publish posts and pages on the site without holding the publish capability.

Affected products

• Unknown Content Mask: from 1.8.0, before 1.8.5.5 (fixed in 1.8.5.5)

Published 2026-08-23. Last modified 2026-08-26.