Cross-Site Request Forgery Vulnerability in PublishPress Series Plugin by WordPress
CVE-2026-74005

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
PublisHPress Series
Vendor
CVE Published:
17 September 2026

What is CVE-2026-74005?

An unauthenticated Cross-Site Request Forgery (CSRF) vulnerability exists in PublishPress Series versions 3.1.3 and earlier. This flaw allows an attacker to execute unauthorized actions on behalf of users without their consent, potentially leading to compromised user accounts and other malicious activities. It is crucial for website administrators to review their installations and apply necessary updates to mitigate the risks associated with this vulnerability.

Affected Version(s)

PublishPress Series <= 3.1.3

References

https://patchstack.com/database/wordpress/plugin/organize...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

benzdeus | Patchstack Bug Bounty Program
.