CVE-2026-88904

PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.

Affected

PuppyFW

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.42% chance of exploitation in the next 30 days, 35th percentile

Published

2026-09-17

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/d65eff64-0c20-4cfe-8ba2-1d202a5e4306/

References

• CVE Record
• NVD entry