PT-2026-56315 · WordPress · Backstage – Customizer Demo Access

Nabil Irawan · CVE-2026-9842 · Published 2026-07-08 · Updated 2026-07-17

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Backstage - Customizer Demo Access versions prior to 1.4.3

Description This issue allows unauthenticated attackers to achieve privilege escalation. The plugin assigns the manage options capability to the backstage customizer user demo role, which provides permissions exceeding what is required for Customizer-only demo access. Consequently, attackers can navigate beyond the Customizer and modify arbitrary WordPress options, such as the default role variable.

Recommendations Update Backstage - Customizer Demo Access to a version newer than 1.4.2.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-9842

Affected Products

Backstage – Customizer Demo Access

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-9842 · Security Note
• https://t.me/cveNotify/191179 · Telegram Post
• https://reddit.com/r/StopBadBots/comments/1uys6rm/267_wordpress_vulnerabilities_dropped_last_week · Reddit Post
• https://t.me/CVEtracker/59327 · Telegram Post
• https://plugins.trac.wordpress.org/browser/backstage/tags/1.4.2/includes/class-Backstage.php#L348 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/5bcf1f02-0946-4e96-a81b-00c7c48d64b3?source=cve · Note
• https://plugins.trac.wordpress.org/browser/backstage/tags/1.4.2/includes/class-Backstage.php#L154 · Note
• https://t.me/cveNotify/190878 · Telegram Post