Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.7 - Authenticated (Contributor+) Missing Authorization to Unauthorized Future Action Scheduling
- ID
- WPSEC-2026-1401
- Plugin
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories (post-expirator)
- Affected
- all versions before 4.11.0
- Remediation
- Update to 4.11.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories on WPSec AttackSurface
- Fix released
- Published
Description
The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to unauthorized future action scheduling via the publishpress_future_action REST field, the post-expiration REST endpoint, the classic editor metabox and bulk edit in all versions up to, and including, 4.10.7, due to missing per-action capability checks. These handlers only verified that the user had the publishpress_future_expire_post capability and could edit the post. This makes it possible for authenticated attackers with Contributor-level access and above who have been granted that capability to schedule actions they cannot perform directly, such as publishing or making private their own drafts, deleting posts, or sticking and unsticking posts, which later run via cron.
References
- https://wpsec.com/vuln/WPSEC-2026-1401/
- https://plugins.svn.wordpress.org/post-expirator/tags/4.11.0/
- https://wordpress.org/plugins/post-expirator/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS