A critical authorization vulnerability in the PuppyFW WordPress plugin allows authenticated users to escalate privileges, potentially leading to a full site compromise.

This vulnerability involves improper privilege management (CWE-269) within a REST API endpoint that incorrectly validates user capabilities based on user-supplied request data. An attacker with any authenticated account, such as a subscriber, can leverage this flaw to manipulate site settings.

The ability for a low-privileged user to modify arbitrary blog options grants an attacker the power to alter site configurations, redirect traffic, or inject malicious code, resulting in complete site takeover. With a CVSS score of 8.8, this flaw represents a significant risk to data integrity and system availability, as it effectively bypasses the WordPress access control model.

Immediate Action: There is no confirmed patch available at this time; administrators should immediately deactivate and remove the PuppyFW plugin until a secure update is released by the vendor.

Proactive Monitoring: Review WordPress user audit logs for unauthorized changes to administrative settings or unexpected creation of new administrator-level accounts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious REST API requests originating from low-privileged user accounts.

Public Exploit Available: Unknown.

Given the potential for total system compromise, administrators must treat this vulnerability with high urgency. Immediately audit your WordPress environment for the presence of the PuppyFW plugin and remove it. If the functionality provided by this plugin is essential, monitor official vendor channels closely for a secure version release and perform a thorough security audit before re-enabling the software.