CVE-2026-88904

תיאור (מקור, אנגלית)

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.

מדדים

CVSS 3.1

8.8 (HIGH) מקור הציון: CNA CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — סבירות ניצול

0% (אחוזון 000) נכון ל-17/9/2026

CWE

CWE-269

קישורים

• https://wpscan.com/vulnerability/d65eff64-0c20-4cfe-8ba2-1d202a5e4306/