Description

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-11-06T06:16:40.820Z",
  "pubdate": "2026-11-06T06:16:40.820Z",
  "executiveSummary": "The PublishPress Revisions plugin, in versions prior to 4.3.1, suffers from an Improper Authorization vulnerability. This flaw resides in the plugin's access control logic, which fails to correctly validate user permissions during the content submission and publication process.\nThe vulnerability allows low-privileged users, specifically those assigned the 'Contributor' role, to bypass established editorial approval workflows. By exploiting this authorization flaw, these users can promote unreviewed content to a publicly visible status without intervention from an administrator or editor.\nThe primary risk implication is the circumvention of content moderation policies and editorial oversight, potentially leading to unauthorized data publication, malicious content injection, or the public disclosure of sensitive drafts. Successful exploitation requires a valid user account with at least 'Contributor' level privileges, but it does not require additional complex configuration. The integrity and confidentiality of the WordPress publishing workflow are compromised, as the plugin fails to enforce role-based access control (RBAC) constraints intended to restrict content publication to authorized administrative roles.",
  "technicalDetails": "The vulnerability is rooted in an insufficient access control check within the PublishPress Revisions plugin's content submission and publication handlers. The plugin is designed to manage revisions and scheduled content updates; however, the logic governing the transition from a 'pending' or 'draft' state to a 'published' state does not adequately verify whether the user initiating the action possesses the 'publish_posts' capability.\nIn a standard WordPress installation, a 'Contributor' role possesses the capability to edit their own posts but lacks the authority to publish them. The core functionality of PublishPress Revisions fails to verify these granular capabilities when processing requests to 'live' a revision. Instead, the plugin relies on insecure validation routines that assume the user possesses the requisite authority to execute publication actions upon interacting with the revision UI.\nThe attack flow proceeds as follows: 1) An authenticated attacker with 'Contributor' privileges creates or edits a post or page. 2) Instead of submitting the content for review, the attacker invokes the plugin-specific functionality meant to handle content revision updates. 3) The plugin processes the update request but fails to perform a server-side check against the current user's role or capabilities. 4) The server updates the post status to 'published,' making the content immediately live on the front end. 5) The intended editorial workflow is bypassed, as the document effectively skips the required approval stage.\nThis vulnerability is classified as an authorization bypass because the application logic improperly transitions state without validating the actor's permissions against the 'publish_posts' WordPress capability. Because the plugin does not enforce this constraint during the interaction with the database API, the post status is modified in the 'wp_posts' table without the appropriate security gatekeeper. This allows the attacker to manipulate content availability regardless of the site's default security configuration. The impact is significant as it grants unauthorized users direct control over the site's public content stream, undermining the fundamental security architecture of the editorial process."
}