low · CVSS v3 2.7
CVE-2026-118187
The PublishPress Revisions plugin (before 4.3.1) fails to verify ownership when duplicating or revising posts, allowing users with contribut
Overview
The PublishPress Revisions plugin (before 4.3.1) fails to verify ownership when duplicating or revising posts, allowing users with contributor-level access to copy private or draft content from other users. This flaw enables unauthorized disclosure of content and potential manipulation of posts. It affects WordPress sites that use the plugin.
Description
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.
Impact
Confidentiality: unauthorized users can read private or draft posts. Integrity: duplicated posts may be altered or misattributed. Availability: not directly impacted. Defenders: site administrators and security teams should monitor for anomalous duplicate actions.
Remediation
Update the plugin to version 4.3.1 or later. If an update is not possible, restrict contributor roles from using the duplicate/revise feature via role management or disable the feature entirely. Monitor audit logs for duplicate or revise actions and review content ownership.
Risk context
Low severity (CVSS 2.7) and no EPSS data suggest a low likelihood of exploitation, but the vulnerability can expose sensitive content. Patching is recommended to eliminate the risk.
Affected products
- PublishPress Revisions
Scores
- Severity
- low
- CVSS v2
- 3.3
- CVSS v3
- 2.7
- CVSS v4
- —
- EPSS
- —