{"id":"CVE-2026-118187","kind":"vulnerability","aliases":["CVE-2026-118187"],"related":[],"title":"PublishPress Revisions WordPress plugin: contributors can copy other users' private posts","description":"The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.","summary":"The PublishPress Revisions WordPress plugin before 4.3.1 does not check that a user may access a specific post before duplicating or revising it. A contributor-level account can duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","publishpress-revisions","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-not-installed","version-4.3.1-or-later"],"how_to_check":"- Check the installed version of the PublishPress Revisions plugin in the WordPress admin plugin list, or in `wp plugin list` if WP-CLI is available.\n- Confirm whether any contributor-level or higher accounts exist that are not fully trusted.","fix":"- PublishPress Revisions: `4.3.1` or later (the fixed version named in the description).","status":"open","published_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","triaged_at":"2026-11-06T06:41:51+00:00","updated_at":"2026-11-06T06:41:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T06:41:51Z","model":"claude-haiku-5-5","output":{"fix":"- PublishPress Revisions: `4.3.1` or later (the fixed version named in the description).","reach":"network","title":"PublishPress Revisions WordPress plugin: contributors can copy other users' private posts","impact":"medium","summary":"The PublishPress Revisions WordPress plugin before 4.3.1 does not check that a user may access a specific post before duplicating or revising it. A contributor-level account can duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","publishpress-revisions","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Contributor reads full content of other users' private and draft posts","analyst_note":"","how_to_check":"- Check the installed version of the PublishPress Revisions plugin in the WordPress admin plugin list, or in `wp plugin list` if WP-CLI is available.\n- Confirm whether any contributor-level or higher accounts exist that are not fully trusted.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-4.3.1-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the PublishPress Revisions plugin before 4.3.1 that have users with contributor-level access or above. Exposure comes from the duplicate and revise actions, which only check that a user can edit posts of that type rather than the specific post. Sites without the plugin, or with only trusted editors and administrators, are less exposed.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000719,"input_tokens":4262,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118187':14A,17A '-2026':13A,16A '4.3.1':32B,88C 'access':40B,103C,123C 'account':53B 'allow':117C 'anoth':56B,128C 'approv':80C 'chang':84C 'check':35B 'content':73B,83C,145C 'contributor':5A,51B,121C 'contributor-level':50B,120C 'copi':7A 'cve':12A,15A 'draft':60B,132C 'duplic':45B,55B,77C,97C,127C 'edit':112C 'full':72B,144C 'host':24B 'level':52B,122C 'may':39B 'one':66B,138C 'packag':18B 'pend':61B,133C 'plugin':4A,30B,86C 'post':11A,43B,64B,78C,101C,107C,113C,136C 'privat':10A,59B,131C 'publishpress':1A,20B,27B,75C 'publishpress-revis':19B 'read':70B,142C 'request':95C 'revis':2A,21B,28B,47B,76C,99C 'schedul':63B,82C,135C 'self':23B 'self-host':22B 'specif':42B,106C 'submit':79C 'type':116C 'user':9A,38B,57B,94C,118C,129C 'verifi':91C 'wordpress':3A,25B,29B,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the PublishPress Revisions plugin before 4.3.1 that have users with contributor-level access or above. Exposure comes from the duplicate and revise actions, which only check that a user can edit posts of that type rather than the specific post. Sites without the plugin, or with only trusted editors and administrators, are less exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","publishpressrevisions","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118187':14A,17A '-2026':13A,16A 'contributor':5A 'copi':7A 'cve':12A,15A 'plugin':4A 'post':11A 'privat':10A 'publishpress':1A 'revis':2A 'user':9A 'wordpress':3A","search_b":"'4.3.1':32B 'access':40B 'account':53B 'anoth':56B 'check':35B 'content':73B 'contributor':51B 'contributor-level':50B 'draft':60B 'duplic':45B,55B 'full':72B 'host':24B 'level':52B 'may':39B 'one':66B 'packag':18B 'pend':61B 'plugin':30B 'post':43B,64B 'privat':59B 'publishpress':20B,27B 'publishpress-revis':19B 'read':70B 'revis':21B,28B,47B 'schedul':63B 'self':23B 'self-host':22B 'specif':42B 'user':38B,57B 'wordpress':25B,29B","search_c":"'4.3.1':88C 'access':103C,123C 'allow':117C 'anoth':128C 'approv':80C 'chang':84C 'content':83C,145C 'contributor':121C 'contributor-level':120C 'draft':132C 'duplic':77C,97C,127C 'edit':112C 'full':144C 'level':122C 'one':138C 'pend':133C 'plugin':86C 'post':78C,101C,107C,113C,136C 'privat':131C 'publishpress':75C 'read':142C 'request':95C 'revis':76C,99C 'schedul':82C,135C 'specif':106C 'submit':79C 'type':116C 'user':94C,118C,129C 'verifi':91C 'wordpress':85C","first_public_at":"2026-11-06T06:16:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118187","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118187","severity":null,"published_at":"2026-11-06T06:16:40+00:00","modified_at":"2026-11-06T06:16:40+00:00","first_seen_at":"2026-11-06T06:40:12+00:00","fetched_at":"2026-11-06T06:40:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}