PT-2026-1750 · WordPress · Publishpress Future

Athiwat Tiprasaharn · Published 2026-01-09 · Updated 2026-01-09 · CVE-2025-14718

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions PublishPress Future versions through 4.9.3

Description The Schedule Post Changes With PublishPress Future plugin for WordPress has an authorization bypass issue. The plugin does not properly verify user authorization, allowing authenticated attackers with Contributor-level access or higher to create, update, delete, and publish malicious workflows. These workflows can automatically delete any post upon publication or update, potentially including posts created by administrators.

Recommendations Update PublishPress Future to a version later than 4.9.3.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-14718

Affected Products

Publishpress Future

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-14718 · Security Note
• https://t.me/cveNotify/148183 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?old_path=/post-expirator/tags/4.9.3/src/Modules/Workflows/Rest/RestApiV1.php&new_path=/post-expirator/tags/4.9.4/src/Modules/Workflows/Rest/RestApiV1.php · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8198d81a-40c0-49c1-8c38-f5ef6fb911ad?source=cve · Note
• https://twitter.com/CVEnew/status/2009526571967652013 · Twitter Post