Improper Authorization in PuppyFW WordPress Plugin Affects User Permissions
CVE-2026-88904
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-88904?
The PuppyFW WordPress plugin, up to version 0.4.4, is vulnerable due to improper authorization mechanisms in its REST API routes. This flaw permits any authenticated user—including those with basic subscriber roles—to manipulate blog settings arbitrary. As a result, users can add, modify, or delete crucial blog options, which could lead to privilege escalation and unauthorized control over the WordPress site.
Affected Version(s)
PuppyFW 0 <= 0.4.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.