CVE-2026-118186: PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow

Published Nov 6, 2026

Updated

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade PublishPress Revisions to a version that resolves this vulnerability.
Fixed in 4.3.1

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

Authenticated users with editing capability but without normal publishing permission, including Contributors, may be able to exploit it. The issue allows them to bypass the intended revision approval workflow.

What should be checked to determine exposure?

Check whether PublishPress Revisions is installed at a version earlier than 4.3.1 and whether lower-privileged users can create or edit revisions. Sites that rely on the plugin’s editorial approval process for posts or pages are affected by the workflow bypass.

Is exploit code known to be available?

A proof-of-concept flag is associated with this vulnerability. No proof-of-concept details are provided in the available data.

CVE-2026-118186: PublishPress Revisions 3.6.0 - 4.2.0 - Contributor+ Unapproved Content Publishing via Revision Workflow

Remediation

Event History

Frequently Asked Questions

Which users can exploit this issue?

What should be checked to determine exposure?

Is exploit code known to be available?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What should be checked to determine exposure?

Is exploit code known to be available?