What is GHSA-f6x2-w8q2-ff47?

GHSA-f6x2-w8q2-ff47 is a security advisory published by GitHub Security Advisories with High severity. The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST...

Which CVE IDs does GHSA-f6x2-w8q2-ff47 cover?

GHSA-f6x2-w8q2-ff47 covers the following CVE IDs: CVE-2026-88904. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f6x2-w8q2-ff47?

GHSA-f6x2-w8q2-ff47 has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

GHSA-f6x2-w8q2-ff47HighCVSS 8.8

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST...

Vendor

GitHub Security Advisories

Published

September 17, 2026

Last Modified

September 17, 2026

🔗 CVE IDs covered (1)

CVE-2026-88904 →

📋 Description

The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-88904
https://wpscan.com/vulnerability/d65eff64-0c20-4cfe-8ba2-1d202a5e4306
https://github.com/advisories/GHSA-f6x2-w8q2-ff47