CVE-2026-84771: PublishPress Permissions IDOR Vulnerability

CVE-2026-84771 Overview

CVE-2026-84771 is an unauthenticated Insecure Direct Object References (IDOR) vulnerability in the PublishPress Permissions WordPress plugin (also known as press-permit-core) affecting versions 4.8.3 and earlier. The flaw is categorized under [CWE-639]: Authorization Bypass Through User-Controlled Key. Remote attackers can manipulate object identifiers in requests to access resources they should not be able to view, without authentication. Successful exploitation results in unauthorized disclosure of information managed by the plugin's permissions layer.

Critical Impact
Unauthenticated network attackers can reference internal object identifiers directly to retrieve data protected by the PublishPress Permissions plugin, bypassing intended authorization checks.

Affected Products

PublishPress Permissions plugin for WordPress (press-permit-core)
Versions 4.8.3 and earlier
WordPress sites relying on the plugin for content access control

Discovery Timeline

2026-09-02 - CVE-2026-84771 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-84771

Vulnerability Analysis

The vulnerability is an Insecure Direct Object Reference in the PublishPress Permissions plugin. The plugin exposes endpoints that accept an object identifier supplied by the client and returns or acts on the referenced object without verifying that the requester is authorized for it. Because the affected endpoint path does not require authentication, any remote user can submit crafted requests referencing arbitrary object IDs. This produces a confidentiality impact against data the plugin governs, while integrity and availability remain unaffected.

Root Cause

The root cause is a missing authorization check on user-controlled input, mapped to [CWE-639]. The plugin trusts an incoming identifier parameter to determine which record to operate on, but it does not correlate that identifier against the caller's session, capability, or role. When authentication is also absent from the request path, the identifier alone is sufficient to reach the target object.

Attack Vector

Exploitation occurs over the network against the WordPress site's HTTP interface. An attacker enumerates or guesses sequential or predictable identifiers and issues requests to the affected plugin endpoint. No user interaction, credentials, or elevated privileges are required. Technical details are available in the Patchstack Vulnerability Report.

No verified proof-of-concept code has been published. The vulnerability mechanism follows the standard IDOR pattern: substitute a target identifier in a request parameter and receive data that should require authorization.

Detection Methods for CVE-2026-84771

Indicators of Compromise

Anonymous HTTP requests to PublishPress Permissions plugin endpoints under /wp-content/plugins/press-permit-core/ or associated AJAX/REST routes
Sequential or enumerated identifier values in query strings or POST bodies from a single source address
Unusually high request volume from unauthenticated sessions targeting plugin URLs

Detection Strategies

Inspect web server access logs for unauthenticated requests carrying object ID parameters directed at press-permit-core routes
Deploy a Web Application Firewall (WAF) rule to flag ID enumeration patterns against WordPress plugin endpoints
Correlate 200-OK responses to unauthenticated plugin requests with the absence of a valid WordPress session cookie

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized platform for retention and analysis
Alert on spikes in requests to plugin endpoints that reference numeric identifiers from unauthenticated clients
Track WordPress plugin version inventory to identify hosts still running PublishPress Permissions 4.8.3 or earlier

How to Mitigate CVE-2026-84771

Immediate Actions Required

Update PublishPress Permissions to a version later than 4.8.3 as soon as a fixed release is available from the vendor
Audit web server logs for prior unauthenticated requests to press-permit-core endpoints referencing object identifiers
Restrict access to WordPress admin and plugin endpoints by IP allowlist where feasible

Patch Information

Refer to the Patchstack Vulnerability Report for the current fixed version and vendor guidance. Apply the vendor-supplied patch through the WordPress plugin update mechanism.

Workarounds

Temporarily deactivate the PublishPress Permissions plugin until a patched version is installed
Add WAF rules that require authenticated session cookies for requests to press-permit-core endpoints
Randomize or obfuscate object identifiers where the application layer permits, to reduce enumeration success

bash

# Example: block unauthenticated access to plugin endpoints at the reverse proxy
location ~* /wp-content/plugins/press-permit-core/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}