WordPress Plugin Vulnerabilities

PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR

Description

The plugin does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.

Proof of Concept

Affects Plugins

Plugin icon
revisionary
Fixed in 4.3.1

References

CVE
CVE-2026-118187

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
2.7 (low)

Miscellaneous

Original Researcher
trangdld
Submitter
trangdld
Verified
Yes
WPVDB ID
c448c858-c5f1-4430-b032-076726715916

Timeline

Publicly Published
2026-11-04 (about 2 days ago)
Added
2026-11-04 (about 1 day ago)
Last Updated
2026-11-04 (about 1 day ago)

Other

Published
Title
Published
2024-10-16
Title
Miniorange OTP Verification with Firebase < 3.6.1 - Unauthenticated Arbitrary User Password Change
Published
2025-03-13
Title
WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover
Published
2026-01-02
Title
Verdure <= 1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-04-07
Title
Masteriyo LMS < 2.1.8 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint
Published
2025-11-20
Title
Return Refund and Exchange For WooCommerce < 4.5.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation