Dashboard / CVE-2026-118186

CVE-2026-118186

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 55/100
Published: 2026-11-06 Modified: 2026-11-06 First seen: 2026-11-06 Status: active

Attack Surface

Network Low Complexity No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
S: Unchanged
C: None
I: High
A: None

Description

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not correctly restrict who may publish content, allowing users such as Contributors who can edit but not publish to make unreviewed posts and pages publicly live, bypassing the intended editorial approval workflow.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
Unknown PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes 3.6.0 < 4.3.1
Unknown PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes 3.6.0 < 4.3.1

References & Advisories (1)

Bug Bounty Relevance

55 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.9 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

EPSS — Exploitation Probability

0.26%
Raw Score 0.002630
Percentile 18.2%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00263
2026-11-12
0.00263
2026-11-10
0.00263
2026-11-09
0.00263
2026-11-08
0.00263
2026-11-07
0.00263
2026-11-06
0.00151

Intelligence Sources

mitre ref →
nvd ref →

External Links