CVE-2026-88904 — PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

CVE-2026-88904

PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation PUBLISHED

Description (CNA)

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.

Affected (CNA)

Vendor / product	Versions
Unknown / PuppyFW	affected 0 through 0.4.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/d65eff64-0c20-4cfe-8ba2-1d202a5e4306/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.