CVE-2026-39444: WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in PublishPress PublishPress Series organize-series allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Series: from n/a through 3.1.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress PublishPress Seriesto a version that resolves this vulnerability.Fixed in 3.1.4
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation is network-accessible, requires low privileges, and does not require user interaction. An attacker would need an authenticated account with low-level permissions.
What versions are affected?
PublishPress Series is affected through version 3.1.3. The available data does not identify a fixed version.
What is the likely impact?
The issue is rated medium severity with a CVSS score of 5.4. It can affect integrity and availability at a low level; no confidentiality impact is indicated.