The PuppyFW plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.4.4. This is due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for authenticated attackers, with subscriber-level access and above, to elevate their privileges beyond those intended for their role.