{
 "id": "WPSEC-2026-3120",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3120/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3120/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3120/index.md",
 "title": "PublishPress Permissions: Access Control, Content Permissions, User Access <= 4.9.1 - Unauthenticated Sensitive Information Exposure via '_ppp' Parameter",
 "description": "The PublishPress Permissions plugin for WordPress is vulnerable to Sensitive Information Exposure via the '_ppp' parameter in all versions up to, and including, 4.9.1, due to a Public Post Preview compatibility routine that disables all permission filtering on any non-POST front-end request carrying a non-empty '_ppp' parameter, without validating a preview token. This makes it possible for unauthenticated attackers to view posts and other content restricted by the plugin's permissions. Exploitation requires the Public Post Preview plugin to be active.",
 "plugin": {
  "slug": "press-permit-core",
  "name": "PublishPress Permissions: Access Control, Content Permissions, User Access",
  "full_name": "PublishPress Permissions: Access Control, Content Permissions, User Access",
  "wordpress_org": "https://wordpress.org/plugins/press-permit-core/",
  "advisories_url": "https://wpsec.com/vuln/plugin/press-permit-core/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/press-permit-core"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.6.4",
    "from_inclusive": true,
    "to": "5.0.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.6.4 before 5.0.0"
  ]
 },
 "introduced_in": "3.6.4",
 "fixed_in": "5.0.0",
 "remediation": "Update to 5.0.0 or later.",
 "fix_released": "2026-11-13T01:22:20+00:00",
 "published": "2026-11-14T01:41:58+00:00",
 "updated": "2026-11-13T15:53:54.350293+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3120/",
  "https://plugins.svn.wordpress.org/press-permit-core/tags/5.0.0/",
  "https://wordpress.org/plugins/press-permit-core/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/press-permit-core",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-13"
 }
}