Executive brief
PuppyFW is a WordPress plugin that extends WordPress administration features. The plugin contains a flaw in its REST API endpoint that allows any logged-in user—even those with minimal permissions (subscribers)—to manipulate critical WordPress settings and options. This can lead to unauthorized privilege escalation, allowing attackers to gain administrative control of the affected WordPress site.
Technical details
The PuppyFW WordPress plugin through version 0.4.4 fails to properly validate user permissions on a REST API route. The vulnerable endpoint accepts a capability parameter from the request itself and tests the authenticated user against that caller-supplied capability, rather than enforcing a fixed, server-side capability check. This allows any authenticated user, including low-privilege subscribers, to add, modify, or delete arbitrary WordPress blog options—including those tied to administrative functions—leading to privilege escalation. The attack requires only authentication (login) to the WordPress site; no additional user interaction or network traversal is needed. No patch has been released at the time of advisory publication.
Affected products
- PuppyFW PuppyFW through 0.4.4
Timeline
- 2026-09-15: disclosed
- 2026-09-17: advisory