CVE-2026-84771: CWE-639 Authorization Bypass Through User-Controlled Key in PublishPress PublishPress Permissions

This vulnerability (CVE-2026-84771) affects PublishPress Permissions plugin versions up to 4.8.3. It is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The issue is an unauthenticated IDOR, meaning that an attacker without authentication can manipulate a key parameter to bypass authorization controls and access restricted objects or data. The CVSS v3.1 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild and no vendor-provided patch or official remediation is documented at this time.

An unauthenticated attacker can bypass authorization controls by exploiting an IDOR vulnerability, potentially gaining unauthorized read access to certain data or resources controlled by the PublishPress Permissions plugin. The impact is limited to confidentiality as per the CVSS vector; integrity and availability are not affected. This could lead to exposure of sensitive information depending on the deployment context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin or implementing additional access controls at the application or network level to mitigate unauthorized access risks.