https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-29T08:23:33.829025+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-88904 CVE-2026-88904 — PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation 2026-09-29T08:23:33.829869+00:00

Affected: Unknown PuppyFW

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.