Is CVE-2026-74005 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-74005 being exploited in the wild.

How severe is CVE-2026-74005?

Medium severity, with a CVSS score of 5.4, published 17 September 2026.

Is there a fix for CVE-2026-74005?

A patch was published on 2026-09-16: Fixed in version 3.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-74005 attacked?

It is attacked over the network.

Am I affected by CVE-2026-74005?

Check whether you run PublishPress Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-74005: PublishPress Series unauthenticated cross-site request forgery

CVE-2026-74005 · Severity: medium · CVSS 5.4 · Published 2026-09-17

PublishPress Series is a WordPress plugin used to organize and manage content series on WordPress sites. This vulnerability allows attackers to trick logged-in administrators or editors into performing unintended actions (such as modifying content, changing settings, or deleting series) by luring them to a malicious webpage. No authentication is required on the attacker's side, making it a low-barrier attack vector.

Technologies: PublishPress Series. Vendors: PublishPress.

Quick answers

Is CVE-2026-74005 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-74005 being exploited in the wild.
How severe is CVE-2026-74005?: Medium severity, with a CVSS score of 5.4, published 17 September 2026.
Which products and versions are affected?: PublishPress Series <=3.1.3.
Is there a fix for CVE-2026-74005?: A patch was published on 2026-09-16: Fixed in version 3.1.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-74005 attacked?: It is attacked over the network.
Am I affected by CVE-2026-74005?: Check whether you run PublishPress Series at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This is a Cross-Site Request Forgery (CSRF) vulnerability affecting PublishPress Series plugin versions up to and including 3.1.3. The plugin fails to properly validate anti-CSRF tokens on certain requests, allowing an unauthenticated attacker to craft a malicious webpage that, when visited by an authenticated WordPress user with sufficient privileges, will execute unintended actions on the target site. The attack requires user interaction (the victim must visit the attacker's page while logged into WordPress). The vulnerability has been patched in version 3.1.4 and later.

Affected products

PublishPress Series <=3.1.3

Timeline

2026-09-16: disclosed: Published by Patchstack
2026-09-16: patched: Fixed in version 3.1.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.