high8.8
CVE-2026-88904
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from…
Impact
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.
Affected products
| Product | Affected versions |
|---|---|
| PuppyFW WordPress Plugin | through 0.4.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.