CVE-2026-94487 describes an unauthenticated CSRF vulnerability in PublishPress Capabilities affecting all versions up to 2.50.1. The vulnerability enables attackers to trick users into executing unintended commands without requiring authentication. The CVSS 3.1 vector indicates the attack can be performed remotely with low complexity and no privileges required, but user interaction is necessary. The impact includes high integrity and availability consequences, though confidentiality is not affected.

The vulnerability can lead to unauthorized modification of data or disruption of service on affected PublishPress Capabilities installations. Because it is unauthenticated, attackers do not need valid credentials to exploit it, increasing the risk. However, exploitation requires user interaction, such as clicking a crafted link or visiting a malicious webpage.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, users should consider mitigating CSRF risks by implementing standard CSRF protections such as verifying request origins and using anti-CSRF tokens where possible.