CVE-2026-88904: PuppyFW WordPress Privilege Escalation

CVE-2026-88904 Overview

CVE-2026-88904 is a broken access control vulnerability in the PuppyFW WordPress plugin through version 0.4.4. The plugin exposes a REST route that validates the caller against a capability value supplied in the request itself. Any authenticated user, including low-privileged subscribers, can specify a capability they already hold and bypass the authorization check. Successful exploitation allows attackers to add, modify, and delete arbitrary blog options, leading to privilege escalation and full site compromise.

Critical Impact
Subscriber-level accounts can modify WordPress options such as default_role and users_can_register, enabling escalation to administrator and full takeover of the affected site.

Affected Products

PuppyFW WordPress plugin
All versions through 0.4.4
WordPress sites with the plugin activated and open user registration

Discovery Timeline

2026-09-17 - CVE-2026-88904 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-88904

Vulnerability Analysis

The vulnerability is classified as Improper Privilege Management [CWE-269]. PuppyFW registers a REST API route that gates access using a permission_callback derived from user-controlled input. Rather than asserting a fixed capability such as manage_options, the endpoint reads a capability name from the request payload and passes it to current_user_can(). An attacker submits a capability the requester already holds, such as read for a subscriber, and the check returns true.

Once the authorization check passes, the endpoint executes option-management logic that calls update_option() and delete_option() against attacker-supplied keys and values. This gives any authenticated user write access to the WordPress options table, which controls site behavior including default user roles, active theme, site URL, and administrator email.

Root Cause

The root cause is trusting request-supplied data to authorize privileged operations. The permission_callback must enforce a hardcoded capability appropriate to the operation. Reading the capability from the request converts the check into a self-attestation that any authenticated caller can satisfy.

Attack Vector

Exploitation requires only a valid WordPress account. On sites that allow open registration, an attacker registers a subscriber account and issues a crafted request to the vulnerable REST route. By setting default_role to administrator and toggling users_can_register to true, the attacker registers a new administrator account and takes over the site. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-88904

Indicators of Compromise

Unexpected changes to WordPress options including default_role, users_can_register, siteurl, home, or admin_email
New administrator accounts created shortly after subscriber registrations
REST API requests to PuppyFW plugin routes originating from low-privileged user sessions
Modified or newly installed themes and plugins without corresponding administrator activity

Detection Strategies

Inspect web server access logs for POST requests to /wp-json/ routes registered by the PuppyFW plugin
Correlate REST route access with the authenticated user role; subscriber-role calls to option-management endpoints are suspicious
Audit the wp_options table for recent modifications using WordPress activity logging plugins

Monitoring Recommendations

Enable WordPress audit logging to record role changes, option updates, and user creation events
Alert on any change to default_role or users_can_register values in production sites
Monitor for privilege escalations from subscriber to administrator within short time windows

How to Mitigate CVE-2026-88904

Immediate Actions Required

Deactivate and remove the PuppyFW plugin until a patched version is confirmed available
Review all administrator accounts and remove any created after suspected compromise
Reset credentials for all administrator and editor accounts on affected sites
Verify default_role is set to subscriber and audit users_can_register configuration

Patch Information

No fixed version has been published as of the NVD entry. The vulnerability affects PuppyFW through 0.4.4. Consult the WPScan Vulnerability Report for updates on patch availability.

Workarounds

Disable open user registration by unchecking Anyone can register under Settings, General
Restrict access to /wp-json/ REST endpoints using a web application firewall rule that blocks PuppyFW routes for non-administrator sessions
Remove the plugin entirely if it is not required for site functionality

bash

# Disable open registration and lock default role via WP-CLI
wp option update users_can_register 0
wp option update default_role subscriber

# Deactivate and remove the vulnerable plugin
wp plugin deactivate puppyfw
wp plugin uninstall puppyfw