---
id: "CVE-2026-118186"
page: "https://infrastack.ai/live/CVE-2026-118186"
kind: "vulnerability"
aliases: ["CVE-2026-118186"]
title: "PublishPress Revisions WordPress plugin lets contributors publish unreviewed content"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "package", "publishpress-revisions", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-version-4.3.1-or-later"]
published_at: "2026-11-06T06:16:40+00:00"
first_seen_at: "2026-11-06T06:40:12+00:00"
updated_at: "2026-11-06T06:41:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118186", "first_seen_at": "2026-11-06T06:40:12+00:00"}]
exploit_sources: []
---

# PublishPress Revisions WordPress plugin lets contributors publish unreviewed content

Link for people: https://infrastack.ai/live/CVE-2026-118186 (this .md is for agents)

The PublishPress Revisions WordPress plugin before 4.3.1 fails to restrict publishing rights, so users who can only edit, such as Contributors, can make posts and pages public. This bypasses the editorial approval workflow the plugin is meant to enforce.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PublishPress Revisions version in the WordPress admin plugins list or the plugin's main file header
- Review which accounts hold the Contributor role and whether they can publish

## Fix

- PublishPress Revisions: `4.3.1` or later

## Timeline

- 2026-11-06T06:40:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118186

## From the sources

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_