Description

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-11-06T06:16:40.927Z",
  "pubdate": "2026-11-06T06:16:40.927Z",
  "executiveSummary": "The PublishPress Revisions plugin before version 4.3.1 contains a critical broken access control vulnerability. The flaw resides in the duplication and revision functionality, which fails to perform adequate authorization checks on the target post being accessed.\nThe vulnerability allows authenticated users with contributor-level privileges or higher to bypass intended access restrictions. By submitting a request to duplicate or revise a post, an attacker can gain unauthorized read access to content they are not permitted to view, including private, draft, pending, or scheduled posts owned by other users.\nThis represents a significant security risk, as it facilitates the unauthorized disclosure of sensitive or proprietary information stored within the WordPress database. An attacker requires a valid account with at least contributor-level access to exploit this vulnerability, making this an elevation of information privilege attack. The impact is primarily categorized as an Improper Access Control issue, leading to potential data exposure.",
  "technicalDetails": "The root cause of this vulnerability is an insecure authorization check within the PublishPress Revisions plugin functionality responsible for duplicating or revising existing posts. While the plugin verifies that the requesting user possesses the general capability to edit posts of a specific type (e.g., 'edit_posts'), it fails to validate whether the user has explicit permission to access or perform operations on the specific post ID provided in the request.\nThe attack flow proceeds as follows: An authenticated user with contributor-level permissions identifies a post ID—which may correspond to a private, draft, pending, or scheduled post that the user should not be authorized to view. The attacker then constructs a malicious request targeting the plugin's duplication or revision endpoint, passing the target post's ID as a parameter. Because the server-side code only validates the user's role-based capability rather than object-level ownership or read permissions, the application processes the request. The plugin subsequently creates a duplicate or a revision of the target content within the context of the attacker's account. This action essentially bypasses the WordPress capability system for content access, effectively revealing the full content of the unauthorized post to the attacker.\nThis vulnerability is classified as Improper Access Control (CWE-285). It is present in all versions of PublishPress Revisions prior to 4.3.1. The vulnerability does not require any specialized network access beyond having a valid, authenticated session on the target WordPress instance. The post-exploitation impact is severe, as it enables an unauthorized user to exfiltrate draft or private content that may contain sensitive information, internal communications, or unreleased publications. This is essentially a form of Insecure Direct Object Reference (IDOR) occurring at the post-object level, where the application trusts the user-supplied post ID without validating the authorization context of the requester against that specific object."
}