Threats tagged 'ghsa-qj79-q7rc-rvm6'

The PublishPress Revisions WordPress plugin before version 4.3.1 contains an access control vulnerability. It fails to verify that a user requesting to duplicate or revise a post actually has access to that specific post, only checking if they can edit posts of that type. This allows users with contributor-level access and above to duplicate private, draft, pending, or scheduled posts owned by other users and read their full content.