The PuppyFW WordPress plugin versions up to 0.4.4 contain an authorization flaw in one of its REST API routes. The route improperly checks user capabilities by relying on a capability value provided in the request, rather than enforcing fixed, server-side authorization rules. This weakness enables any authenticated user to manipulate blog options arbitrarily, leading to privilege escalation beyond their intended access level.

Any authenticated user, including those with minimal privileges such as subscribers, can exploit this vulnerability to modify blog options. This can lead to unauthorized changes in site configuration and privilege escalation, potentially compromising the integrity and security of the WordPress site.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user roles carefully and monitor for suspicious activity related to blog option changes.