CVE-2026-88904CWE-269privilege-escalation

CVE-2026-88904

High · published September 17, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
35.0
In the wild
Unconfirmed
What it is

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00417 · 35.0th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-09-17T10:16Z
References (1)
https://wpscan.com/vulnerability/d65eff64-0c20-4cfe-8ba2-1d202a5e4306/ · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 0%
    epss
  • 17 SEP 06:00Z
    PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
    cvelistv5