WordPress Plugin Vulnerabilities

PublishPress Permissions: Access Control, Content Permissions, User Access < 4.8.4 - Unauthenticated Insecure Direct Object Reference

Description

The PublishPress Permissions: Access Control, Content Permissions, User Access plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.8.3. This is due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
press-permit-core
Fixed in 4.8.4

References

CVE
CVE-2026-84771
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/149f5463-8777-4906-b87e-14f5b8178763

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Brobicho
Verified
No
WPVDB ID
0f4bed16-6641-4537-acb1-e2bce0da1730

Timeline

Publicly Published
2026-09-02 (about 19 days ago)
Added
2026-09-09 (about 11 days ago)
Last Updated
2026-09-09 (about 11 days ago)

Other

Published
Title
Published
2026-07-24
Title
TaxoPress < 3.51.0 - Contributor+ Private Post Disclosure via IDOR
Published
2026-04-10
Title
Tutor LMS < 3.9.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification
Published
2024-04-24
Title
SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR
Published
2026-09-03
Title
SmartyParcel – Multi-Carrier Shipping, Order Tracking & Live Rates for WooCommerce <= 1.22.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2024-08-16
Title
Zephyr Project Manager < 3.3.101 - Authenticated (Subscriber+) Insecure Direct Object Reference