CVE-2026-88904

Name of the Vulnerable Software and Affected Versions PuppyFW versions prior to 0.4.5

Description Insufficient authorization on a REST route allows any authenticated user, including those with subscriber roles, to add, modify, or delete arbitrary blog options. This occurs because the plugin validates the caller against a capability provided within the request itself, which can be manipulated to achieve privilege escalation.

Recommendations Update PuppyFW to version 0.4.5 or later.