PT-2026-56315 · Pixelgrade · Backstage – Customizer Demo Access

Nabil Irawan · Publicado 2026-07-08 · Atualizado 2026-07-08 · CVE-2026-9842

Mitre

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

The Backstage - Customizer Demo Access plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2. This is due to the plugin assigning the manage options capability to the backstage customizer user demo role, which is more permissive than necessary for Customizer-only demo access. This makes it possible for unauthenticated attackers to navigate beyond the Customizer and update arbitrary WordPress options such as default role, leading to privilege escalation.

Correção

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2026-9842

Produtos afetados

Backstage – Customizer Demo Access

Referências · 4

• https://wordfence.com/threat-intel/vulnerabilities/id/5bcf1f02-0946-4e96-a81b-00c7c48d64b3?source=cve · Nota
• https://plugins.trac.wordpress.org/browser/backstage/tags/1.4.2/includes/class-Backstage.php#L154 · Nota
• https://plugins.trac.wordpress.org/browser/backstage/tags/1.4.2/includes/class-Backstage.php#L348 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9842 · Nota de Segurança