I've found a bug,if a player writes in command_block : /permissionex:promote @p he will be promoted without having the permission .

And other commands................./pex user @p prefix .........../pex user @p group add....
Could you solve this ?

This is why Minecraft itself tells you not to give commandblocks to just anyone on a server.

Yeah, command blocks run all commands with all by design -- nothing we can do about it in Bukkit.

Sponge allows assigning permissions to command blocks however, which would allow you to be more granular in how you allow users to use command blocks.