PT-2025-51474 · WordPress · Publishpress Future+1

Athiwat Tiprasaharn · Published 2025-12-16 · Updated 2025-12-16 · CVE-2025-13741

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories versions up to and including 4.9.2

Description The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress has an issue where data can be accessed without authorization. This is due to a missing capability check on the getAuthors function. Authenticated attackers with Contributor-level access or higher can retrieve emails for all users who have the edit posts capability.

Recommendations Versions prior to and including 4.9.2 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-13741

Affected Products

Publishpress Future

Wordpress

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-13741 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/2f67da8c-da60-4c77-a8b8-7dfc027662e9?source=cve · Note
• https://t.me/CVEtracker/39952 · Telegram Post
• https://t.me/cveNotify/145921 · Telegram Post
• https://plugins.trac.wordpress.org/browser/post-expirator/tags/4.9.1/src/Modules/Workflows/Rest/RestApiV1.php#L376 · Note