Contributor publishing bypass via missing capability check

Privilege escalation in Alex Content Mask before 1.8.5.5 allows remote authenticated users with Contributor access to publish content. The create_new_content_mask AJAX action accepts a target post type and creates it with published status without checking that type’s publish capability. A Contributor account and valid action tokens are required; successful exploitation exposes attacker-chosen posts, pages, redirects, or framed content to site visitors.