CVE-2026-118187: PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

Q: Which users can exploit this issue?

A user with contributor-level access or higher can exploit it, provided they have permission to edit the relevant post type. The vulnerable check does not require access to the specific target post.

Q: What content can be disclosed?

An attacker can duplicate another user's private, draft, pending, or scheduled post into a post they own, then read the duplicated post's full content.

Q: Are published posts required for exploitation?

No. The issue specifically exposes content that is not publicly available, including private, draft, pending, and scheduled posts.

Q: How can I tell whether my site is affected?

Sites using PublishPress Revisions versions before 4.3.1 are affected. A practical verification is whether a contributor or higher-privileged test account can duplicate a post it does not own and access the copied content.

Published Nov 6, 2026

Updated

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

A user with contributor-level access or higher can exploit it, provided they have permission to edit the relevant post type. The vulnerable check does not require access to the specific target post.

What content can be disclosed?

An attacker can duplicate another user's private, draft, pending, or scheduled post into a post they own, then read the duplicated post's full content.

Are published posts required for exploitation?

No. The issue specifically exposes content that is not publicly available, including private, draft, pending, and scheduled posts.

How can I tell whether my site is affected?

Sites using PublishPress Revisions versions before 4.3.1 are affected. A practical verification is whether a contributor or higher-privileged test account can duplicate a post it does not own and access the copied content.

CVE-2026-118187: PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

Event History

Frequently Asked Questions

Which users can exploit this issue?

What content can be disclosed?

Are published posts required for exploitation?

How can I tell whether my site is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What content can be disclosed?

Are published posts required for exploitation?

How can I tell whether my site is affected?