Vulnerabilities / PublishPress Permissions: Access Control, Content Permissions, User Access / WPSEC-2026-3120
PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.9.1 - Unauthenticated Sensitive Information Exposure via '_ppp' Parameter
Medium 5.9
CWE-863Fixed in 5.0.0
- ID
- WPSEC-2026-3120
- Plugin
- PublishPress Permissions: Access Control, Content Permissions, User Access (press-permit-core)
- Affected
- from 3.6.4 before 5.0.0
- Remediation
- Update to 5.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-13
- Attack surface
- PublishPress Permissions: Access Control, Content Permissions, User Access on WPSec AttackSurface
- Fix released
- Published
Description
The PublishPress Permissions plugin for WordPress is vulnerable to Sensitive Information Exposure via the '_ppp' parameter in all versions up to, and including, 4.9.1, due to a Public Post Preview compatibility routine that disables all permission filtering on any non-POST front-end request carrying a non-empty '_ppp' parameter, without validating a preview token. This makes it possible for unauthenticated attackers to view posts and other content restricted by the plugin's permissions. Exploitation requires the Public Post Preview plugin to be active.
References
- https://wpsec.com/vuln/WPSEC-2026-3120/
- https://plugins.svn.wordpress.org/press-permit-core/tags/5.0.0/
- https://wordpress.org/plugins/press-permit-core/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS