{
 "id": "WPSEC-2026-1401",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1401/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1401/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1401/index.md",
 "title": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.10.7 - Authenticated (Contributor+) Missing Authorization to Unauthorized Future Action Scheduling",
 "description": "The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to unauthorized future action scheduling via the publishpress_future_action REST field, the post-expiration REST endpoint, the classic editor metabox and bulk edit in all versions up to, and including, 4.10.7, due to missing per-action capability checks. These handlers only verified that the user had the publishpress_future_expire_post capability and could edit the post. This makes it possible for authenticated attackers with Contributor-level access and above who have been granted that capability to schedule actions they cannot perform directly, such as publishing or making private their own drafts, deleting posts, or sticking and unsticking posts, which later run via cron.",
 "plugin": {
  "slug": "post-expirator",
  "name": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories",
  "full_name": "Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories",
  "wordpress_org": "https://wordpress.org/plugins/post-expirator/",
  "advisories_url": "https://wpsec.com/vuln/plugin/post-expirator/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/post-expirator"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.11.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.11.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.11.0",
 "remediation": "Update to 4.11.0 or later.",
 "fix_released": "2026-10-20T19:23:14+00:00",
 "published": "2026-10-21T19:42:05+00:00",
 "updated": "2026-10-21T10:34:48.243592+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1401/",
  "https://plugins.svn.wordpress.org/post-expirator/tags/4.11.0/",
  "https://wordpress.org/plugins/post-expirator/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/post-expirator",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}