WordPress Plugin Vulnerabilities

PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

Description

The plugin does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.

Proof of Concept

Affects Plugins

Plugin icon
puppyfw
No known fix

References

CVE
CVE-2026-88904

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
8.8 (high)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
d65eff64-0c20-4cfe-8ba2-1d202a5e4306

Timeline

Publicly Published
2026-09-15 (about 2 days ago)
Added
2026-09-15 (about 1 day ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2026-05-28
Title
Advanced Custom Fields: Extended < 0.9.2.6 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
Published
2026-08-22
Title
Security Hardener < 2.4.5 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite
Published
2024-12-13
Title
Frontend Admin by DynamiApps < 3.25.1 - Unauthenticated Privilege Escalation
Published
2025-07-28
Title
Custom API for WP < 4.2.3 - Subscriber+ Privilege Escalation
Published
2025-07-11
Title
The E-Commerce ERP <= 2.1.1.3 - Unauthenticated Privilege Escalation