CVE-2026-120851: WordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability
Published Nov 6, 2026
·Updated
Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress PublishPress Revisionsto a version that resolves this vulnerability.Fixed in 4.3.1
Event History
Nov 6, 2026
CVE Published
via MITRE·10:29 PM
Data Sourced
via MITRE·10:29 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·11:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations are affected?
PublishPress Revisions versions through 4.2.0 are affected. The provided data does not identify a fixed version.
2
What access conditions are required for exploitation?
The issue is described as missing authorization that can be exploited through incorrectly configured access-control security levels. The provided data does not specify the attacker role, authentication requirement, or exact permissions involved.