CyberRota Analysis
AI-GeneratedThe PuppyFW WordPress plugin versions up to 0.4.4 are vulnerable due to inadequate authorization on a REST route, enabling any authenticated user, including subscribers, to manipulate blog options. This flaw allows for privilege escalation, potentially compromising the integrity of the WordPress site. WordPress administrators and users of the PuppyFW plugin should prioritize this issue to prevent unauthorized access and modifications.
Original NVD Description
The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges.