CVE-2026-84771: WordPress PublishPress Permissions plugin <= 4.8.3 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress PublishPress Permissions Pluginto a version that resolves this vulnerability.Fixed in 4.8.4
Event History
Frequently Asked Questions
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges to attempt exploitation over the network.
Which installations are affected?
PublishPress Permissions versions 4.8.3 and earlier are identified as affected. The provided information does not state whether any particular plugin configuration or feature must be enabled.
What is the likely impact?
The supplied severity vector indicates low confidentiality impact, with no stated integrity or availability impact. This is consistent with unauthorized access to exposed objects or data through insecure object references.
What should be done if the plugin is deployed?
Update PublishPress Permissions to a version later than 4.8.3 if available. The provided information does not include a documented workaround or mitigation for installations that cannot be updated immediately.