CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getAuthors function in all versions up to, and including, 4.9.2. This makes it possible for authenticated attackers, with Contributor-level access and above, to retrieve emails for all users with edit_posts capability.
Explanation of Vulnerability in Simple Terms
The PublishPress Schedule Post Changes plugin for WordPress contains an authorization flaw that allows authenticated users with low privileges to read sensitive information they should not access. An attacker with a basic user account can view data that is normally restricted to higher-privilege roles. The vulnerability affects versions up to 4.9.2 and requires a valid WordPress login to exploit.
What an attacker can do
Read sensitive information restricted to higher-privilege users.
Potential impact on your site
Unauthorized information disclosure to any logged-in user, potentially exposing private post data or scheduling details.
Conditions required to exploit
Attacker must have a valid low-privilege WordPress user account.
Key dates
External resources
Related vulnerabilities
