{"affected":[{"defaultStatus":"unaffected","product":"PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"4.3.1","status":"affected","version":"3.9.0","versionType":"semver"}]}],"cveId":"CVE-2026-118188","cwes":["CWE-200"],"description":"The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/4bdd6e0a-1991-4fdd-95a1-bca4f4445d8f/"}],"kev":null,"metrics":[],"modifiedAt":1793944828603,"publishedAt":1793944828603,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/4bdd6e0a-1991-4fdd-95a1-bca4f4445d8f/"}],"remediation":[],"revision":"222e5a825a42bca480d244cb1299acaa25fc502c588eb26598dabac27128c1a3","sources":[{"modifiedAt":1793944828603,"name":"CNA: WPScan","retrievedAt":1793945323756,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118188"}],"ssvc":null,"status":"published","title":"PublishPress Revisions 3.9.0 - 4.2.0 - Subscriber+ Unpublished Content Disclosure","updatedAt":1793945323756}