{"id":"CVE-2026-118186","kind":"vulnerability","aliases":["CVE-2026-118186"],"related":[],"title":"PublishPress Revisions WordPress plugin lets contributors publish unreviewed content","description":"The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.","summary":"The PublishPress Revisions WordPress plugin before 4.3.1 fails to restrict publishing rights, so users who can only edit, such as Contributors, can make posts and pages public. This bypasses the editorial approval workflow the plugin is meant to enforce.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","publishpress-revisions","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-4.3.1-or-later"],"how_to_check":"- Check the installed PublishPress Revisions version in the WordPress admin plugins list or the plugin's main file header\n- Review which accounts hold the Contributor role and whether they can publish","fix":"- PublishPress Revisions: `4.3.1` or later","status":"open","published_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:52+00:00","updated_at":"2026-11-06T06:41:52+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:41:52Z","model":"claude-haiku-5-5","output":{"fix":"- PublishPress Revisions: `4.3.1` or later","reach":"network","title":"PublishPress Revisions WordPress plugin lets contributors publish unreviewed content","impact":"low","summary":"The PublishPress Revisions WordPress plugin before 4.3.1 fails to restrict publishing rights, so users who can only edit, such as Contributors, can make posts and pages public. This bypasses the editorial approval workflow the plugin is meant to enforce.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","publishpress-revisions","cms"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Unreviewed posts and pages are published publicly without approval","analyst_note":"","how_to_check":"- Check the installed PublishPress Revisions version in the WordPress admin plugins list or the plugin's main file header\n- Review which accounts hold the Contributor role and whether they can publish\n- unknown for other checks","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-version-4.3.1-or-later"],"who_is_affected":"Sites running the PublishPress Revisions plugin before 4.3.1 that use editorial workflows with Contributor or similar roles. Sites without this plugin or without a review workflow are not affected by this flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000683,"input_tokens":4243,"output_tokens":517,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118186':12A,15A '-2026':11A,14A '4.3.1':28B,75C 'allow':84C 'approv':53B,67C,107C 'bypass':50B,103C 'chang':71C 'cms':16B 'content':9A,70C,83C 'contributor':6A,42B,88C 'correct':78C 'cve':10A,13A 'duplic':64C 'edit':39B,91C 'editori':52B,106C 'enforc':60B 'fail':29B 'intend':105C 'let':5A 'live':102C 'make':44B,96C 'may':81C 'meant':58B 'packag':17B 'page':47B,100C 'plugin':4A,26B,56B,73C 'post':45B,65C,98C 'public':48B,101C 'publish':7A,32B,82C,94C 'publishpress':1A,19B,23B,62C 'publishpress-revis':18B 'restrict':31B,79C 'revis':2A,20B,24B,63C 'right':33B 'schedul':69C 'submit':66C 'unreview':8A,97C 'user':35B,85C 'wordpress':3A,21B,25B,72C 'workflow':54B,108C","nicknames":[],"mitigations":[],"who_affected":"Sites running the PublishPress Revisions plugin before 4.3.1 that use editorial workflows with Contributor or similar roles. Sites without this plugin or without a review workflow are not affected by this flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cms","medium","package","publishpressrevisions","wordpress"],"campaign_type":null,"search_a":"'-118186':12A,15A '-2026':11A,14A 'content':9A 'contributor':6A 'cve':10A,13A 'let':5A 'plugin':4A 'publish':7A 'publishpress':1A 'revis':2A 'unreview':8A 'wordpress':3A","search_b":"'4.3.1':28B 'approv':53B 'bypass':50B 'cms':16B 'contributor':42B 'edit':39B 'editori':52B 'enforc':60B 'fail':29B 'make':44B 'meant':58B 'packag':17B 'page':47B 'plugin':26B,56B 'post':45B 'public':48B 'publish':32B 'publishpress':19B,23B 'publishpress-revis':18B 'restrict':31B 'revis':20B,24B 'right':33B 'user':35B 'wordpress':21B,25B 'workflow':54B","search_c":"'4.3.1':75C 'allow':84C 'approv':67C,107C 'bypass':103C 'chang':71C 'content':70C,83C 'contributor':88C 'correct':78C 'duplic':64C 'edit':91C 'editori':106C 'intend':105C 'live':102C 'make':96C 'may':81C 'page':100C 'plugin':73C 'post':65C,98C 'public':101C 'publish':82C,94C 'publishpress':62C 'restrict':79C 'revis':63C 'schedul':69C 'submit':66C 'unreview':97C 'user':85C 'wordpress':72C 'workflow':108C","first_public_at":"2026-11-06T06:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118186","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118186","severity":null,"published_at":"2026-11-06T06:16:40+00:00","modified_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}