{"affected":[{"defaultStatus":"unaffected","product":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.3.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118187","cwes":["CWE-639"],"description":"The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user requesting to duplicate or revise a post has access to that specific post, only that they can edit posts of that type, allowing users with contributor-level access and above to duplicate another user's private, draft, pending or scheduled post into one they own and read its full content.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/c448c858-c5f1-4430-b032-076726715916/"}],"kev":null,"metrics":[],"modifiedAt":1793944828429,"publishedAt":1793944828429,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/c448c858-c5f1-4430-b032-076726715916/"}],"remediation":[],"revision":"f5c00ff184a185b4a545093f0852261884b048e47d0c717787c1b9c11fc33816","sources":[{"modifiedAt":1793944828429,"name":"CNA: WPScan","retrievedAt":1793945322643,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118187"}],"ssvc":null,"status":"published","title":"PublishPress Revisions < 4.3.1 - Contributor+ Unpublished Content Disclosure via IDOR","updatedAt":1793945322643}