CVE-2026-118187 · Package
NO FIX YET · SEE WHAT TO DO
The PublishPress Revisions WordPress plugin before 4.3.1 does not check that a user may access a specific post before duplicating or revising it. A contributor-level account can duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the PublishPress Revisions plugin before 4.3.1 that have users with contributor-level access or above. Exposure comes from the duplicate and revise actions, which only check that a user can edit posts of that type rather than the specific post. Sites without the plugin, or with only trusted editors and administrators, are less exposed.
Not affected if no-contributor-accounts, plugin-not-installed, version-4.3.1-or-later
Who cares publishpress-revisions, self-hosted, wordpress
wp plugin list if WP-CLI is available.4.3.1 or later (the fixed version named in the description).The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.