Description

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-11-06T06:16:41.033Z",
  "pubdate": "2026-11-06T06:16:41.033Z",
  "executiveSummary": "The PublishPress Revisions plugin, in versions prior to 4.3.1, suffers from an Improper Authorization vulnerability within its revision-comparison functionality. This security flaw enables authenticated users, regardless of their assigned role or permission level, to bypass access control mechanisms and unauthorizedly retrieve sensitive information from private, draft, pending, scheduled, or trashed posts.\nThe vulnerability type is classified as Broken Access Control (CWE-862). The impact is significant, as it facilitates the unauthorized disclosure of potentially sensitive, confidential, or proprietary content that should remain restricted to administrators or authorized authors. Any authenticated user, including those with minimal privileges such as 'Subscriber', can exploit this flaw.\nThe attack is performed through the plugin's revision-comparison feature, which fails to implement appropriate access checks before querying and returning post metadata and content. Successful exploitation requires an active user session but does not necessitate elevated privileges or specialized technical sophistication, posing a severe risk to data confidentiality across affected WordPress installations.",
  "technicalDetails": "The root cause of this vulnerability lies in the insecure implementation of the revision-comparison feature within the PublishPress Revisions plugin versions before 4.3.1. When a comparison request is initiated, the plugin’s backend logic fails to perform authorization checks to verify whether the requesting user possesses the necessary capabilities (such as 'edit_posts' or specific meta-capabilities) to view or compare the targeted post object.\nThe vulnerability exists in the server-side code responsible for fetching and preparing post content for the diff/comparison view. Instead of validating user permissions against the post's status and ownership, the code retrieves the content directly from the database based on the provided post identifier. Because the API endpoints or hooks handling these requests assume that the incoming request is implicitly authorized if the user is logged in, they lack the necessary conditional checks to verify access rights to non-public post types or states.\nThe exploitation flow typically involves an attacker identifying a target post ID, even if that post is not public (e.g., a draft or a post scheduled for future publication). The attacker submits an authenticated request to the vulnerable revision-comparison endpoint, specifying the target post ID. Upon receipt of this request, the plugin fetches the sensitive content—specifically the post title, main content body, and excerpt—and returns it to the user's browser for rendering in the comparison interface.\nThis behavior bypasses the standard WordPress 'map_meta_cap' or 'current_user_can' checks that would normally restrict such access. Consequently, an attacker with a low-privileged account (Subscriber) can systematically iterate through post IDs to enumerate content that should be hidden from their view. The post-exploitation impact includes the full exposure of draft or internal content, which may contain sensitive business intelligence, future marketing strategy, or private user information, leading to potential data breaches and intellectual property loss."
}