---
id: "CVE-2026-120851"
page: "https://infrastack.ai/live/CVE-2026-120851"
kind: "vulnerability"
aliases: ["CVE-2026-120851"]
title: "PublishPress Revisions: missing authorization lets users exceed access control levels"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "publishpress-revisions", "wordpress"]
not_affected_if: ["newer-version", "plugin-not-installed"]
published_at: "2026-11-06T23:17:21+00:00"
first_seen_at: "2026-11-06T23:44:35+00:00"
updated_at: "2026-11-06T23:45:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120851", "first_seen_at": "2026-11-06T23:44:35+00:00"}]
exploit_sources: []
---

# PublishPress Revisions: missing authorization lets users exceed access control levels

Link for people: https://infrastack.ai/live/CVE-2026-120851 (this .md is for agents)

PublishPress Revisions, a WordPress plugin for content revision workflows, has a missing authorization check that lets access control security levels be exploited when they are misconfigured. An attacker with the access the plugin grants could reach content or actions their role should not allow.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PublishPress Revisions (revisionary) plugin version in the WordPress admin Plugins page or `wp plugin get revisionary --field=version`
- Review whether the site uses custom access control security levels for revisions

## Fix

- PublishPress Revisions: versions after `4.2.0` (fixed version not stated in the sources)

## Timeline

- 2026-11-06T23:44:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120851

## From the sources

Missing Authorization vulnerability in PublishPress PublishPress Revisions revisionary allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PublishPress Revisions: from n/a through 4.2.0.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_