PublishPress Series EUVD-2026-91662

Requires a valid authenticated WordPress account with at least low-level privileges (PR:L) on a site running PublishPress Series (organize-series plugin) version n/a through 3.1.3; the attacker then supplies an attacker-chosen object identifier (the user-controlled key) to reach series resources belonging to other users. Exploitation is limited by the authentication requirement - fully unauthenticated users cannot trigger it - and by the partial impact (integrity and availability only, no data disclosure, C:N). No user interaction is needed (UI:N) and the flaw is reachable over the network against a standard plugin installation, but it depends on the site both running the vulnerable plugin and permitting self- or open-registration low-privilege accounts for broad reachability.

This is a moderate-risk, authenticated IDOR (CWE-639) rather than a top-tier priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, base 5.4) indicates network-reachable, low-complexity exploitation but requires an authenticated low-privilege account (PR:L), and impact is limited to partial integrity and availability with no confidentiality loss (C:N). No EPSS score was supplied, the CVE is not listed in CISA KEV, and no proof-of-concept is referenced - so exploitation is 'no public exploit identified at time of analysis.' An SSVC framing would place this at low urgency: exploitation is not active, technical impact is partial, and automatability is constrained by the need for a valid authenticated session. The signals are internally consistent (the description's 'incorrectly configured access control' and 'user-controlled key' align well with an IDOR under PR:L), so there is no network-vs-local contradiction here. Missing data to note explicitly: no EPSS probability, no KEV/POC confirmation, and the single Patchstack reference is the only intelligence source - affected-version detail ('n/a through 3.1.3') and fix availability are not independently corroborated by a vendor advisory in the provided data.

An attacker who holds a low-privilege authenticated account (e.g., a subscriber or contributor) on a WordPress site running PublishPress Series ≤ 3.1.3 manipulates an object identifier (the user-controlled key) in a plugin request to reference series objects they do not own. Because access-control checks are incorrectly configured, the request succeeds, letting them modify or disrupt series data belonging to other users. No public proof-of-concept is referenced, and low attack complexity (AC:L) means the manipulation is straightforward once authenticated.