CVE-2025-13149: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13149?
CVE-2025-13149 has a severity rating that indicates a vulnerability allowing unauthorized modification of data.
How do I fix CVE-2025-13149?
To fix CVE-2025-13149, update the PublishPress Future plugin to version 4.9.2 or later.
What versions of PublishPress Future are affected by CVE-2025-13149?
CVE-2025-13149 affects all versions of PublishPress Future up to and including 4.9.1.
What type of vulnerability is CVE-2025-13149?
CVE-2025-13149 is a data modification vulnerability due to missing authorization checks.
What functionality is impacted by CVE-2025-13149?
CVE-2025-13149 impacts the 'saveFutureActionData' function of the PublishPress Future plugin.