CVE-2026-74005: WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Request Forgery (CSRF) vulnerability
Published Sep 17, 2026
·Updated
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.
Affected Software
1 affected component
WordPress PublishPress Series<=3.1.3
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/PublishPress Seriesto a version that resolves this vulnerability.Fixed in 3.1.4
Event History
Sep 17, 2026
CVE Published
via MITRE·01:24 PM
Data Sourced
via MITRE·01:24 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Who is exposed to this issue?
WordPress sites using PublishPress Series version 3.1.3 or earlier are affected. Exploitation is unauthenticated, but it requires a user to interact with a malicious request.
2
What does an attacker need to exploit it?
The attacker does not need WordPress credentials. They need to cause a target user to perform an action, consistent with the user-interaction requirement in the CVSS vector.
3
What is the potential impact?
The issue can affect integrity and availability at a low level. The provided severity information indicates no confidentiality impact.