CVE-2026-74005
MediumCVSS 5.4Summary
Cross Site Request Forgery (CSRF) vulnerability in PublishPress Series plugin up to version 3.1.3. CSRF attacks can be performed without authentication, allowing forced actions on behalf of a logged-in admin.
Risk Assessment
An attacker can force an admin to perform actions like changing settings, deleting content, or adding new users. This may lead to unauthorized changes and integrity compromise.
Recommendation
Update the PublishPress Series plugin to version 3.1.4 or later. Additionally, use CSRF tokens and validate requests.
Other vulnerabilities in PublishPress Series
See all- CVE-2026-66630High
The PublishPress Series plugin in versions up to and including 3.1.3 contains an Administrator SQL Injection vulnerability. This enables an administrator-level user to inject malicious SQL code into database queries.
- CVE-2026-66617Medium
Cross Site Scripting (XSS) vulnerability in PublishPress Series plugin up to version 3.1.3, affecting Contributor accounts. It allows injection of malicious JavaScript into publication content, which executes in other users' browsers.
- CVE-2026-27365Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series from n/a through 2.17.0.
Original NVD description (English source)
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Series <= 3.1.3 versions.