CVE-2024-11154 | BDVDB-2026-256138 Detail
publishpressPublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes
Description#
The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact none. Attack vector: network.
Weaknesses#
- CWE-862 Missing Authorization
References#
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c785b7a0-5091-4d89-87d3-cd7d9984553e?source=cve
- https://github.com/publishpress/PublishPress-Revisions/blob/master/admin/history_rvy.php#L322
- https://plugins.trac.wordpress.org/browser/revisionary/trunk/admin/history_rvy.php#L322
- https://plugins.trac.wordpress.org/changeset/3192492/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.