CVE-2026-84771
Received Received - Intake

Unauthenticated IDOR in PublishPress Permissions

Publication date: 2026-09-02

Last updated on: 2026-09-02

Assigner: Patchstack

Description
Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-02
Last Modified
2026-09-02
Generated
2026-09-02
AI Q&A
2026-09-02
EPSS Evaluated
N/A
NVD
CVE-2026-84771
EUVD
EUVD-2026-69939

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
publishpress permissions to 4.8.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an Insecure Direct Object References (IDOR) vulnerability in PublishPress Permissions plugin versions 4.8.3 and below. It allows unauthorized users to bypass access controls and potentially access sensitive files, folders, or database interactions without authentication.

Detection Guidance

Detecting this IDOR vulnerability requires checking the PublishPress Permissions plugin version. Inspect the plugin files in your WordPress installation directory, typically under /wp-content/plugins/publishpress-permissions/. Look for version 4.8.3 or below in the plugin's main file or changelog.

Impact Analysis

An attacker could exploit this to access restricted data or perform unauthorized actions. The impact includes potential data breaches, unauthorized modifications, or information disclosure. The CVSS score of 5.3 indicates low severity but still requires attention.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR (data protection) and HIPAA (health information). Organizations may face legal penalties or reputational damage if exploited.

Mitigation Strategies

Immediately update the PublishPress Permissions plugin to version 4.8.4 or later. If updating is not possible, disable the plugin temporarily until you can apply the patch. Enable auto-updates for the plugin if available through your WordPress admin panel or hosting provider.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84771. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart