WordPress Plugin Vulnerabilities

PublishPress Authors < 4.11.0 - Missing Authorization

Description

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.10.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
publishpress-authors
Fixed in 4.11.0

References

CVE
CVE-2026-25330
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ada8f195-ae5f-4f45-83b4-dd5b89e26ac9

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
johska
Verified
No
WPVDB ID
b608aa06-0404-4e83-8784-302ce577f61c

Timeline

Publicly Published
2026-02-06 (about 3 months ago)
Added
2026-05-04 (about 9 days ago)
Last Updated
2026-05-04 (about 9 days ago)

Other

Published
Title
Published
2024-01-31
Title
WooCommerce Conversion Tracking < 2.0.12 - Subscriber+ Addon Installation
Published
2024-06-03
Title
WP Translate <= 5.3.0 - Missing Authorization
Published
2024-04-05
Title
Easy Social Share Buttons < 9.5 - Missing Authorization
Published
2025-10-14
Title
Library Management System < 3.2 - Missing Authorization to Authenticated (Subscriber+) Settings Manipulation
Published
2026-03-25
Title
FormLift for Infusionsoft Web Forms < 7.5.22 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow