# CVE-2026-120851: PublishPress Revisions broken access control in revisionary

Source: https://junglewise.ai/threats/cve-2026-120851-missing-authorization-vulnerability-in-publishpress-publishpress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-120851 · Severity: medium · CVSS 4.3 · Published 2026-11-06

PublishPress Revisions is a WordPress plugin that manages content revisions and post workflow. A broken access control flaw allows users with contributor-level permissions to access or modify pages and revisions they should not be able to reach, potentially exposing private content or enabling unauthorized edits.

Technologies: [PublishPress Revisions](https://junglewise.ai/threats/technologies/revisions). Vendors: [PublishPress](https://junglewise.ai/threats/vendors/publishpress).

## Quick answers

**Is CVE-2026-120851 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-120851 being exploited in the wild.

**How severe is CVE-2026-120851?** Medium severity, with a CVSS score of 4.3, published 6 November 2026.

**Which products and versions are affected?** PublishPress Revisions through 4.2.0.

**Is there a fix for CVE-2026-120851?** Yes: fixed in 4.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-120851 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-120851?** Check whether you run PublishPress Revisions at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 4.3.1

## Technical details

A missing authorization vulnerability in the revisionary component allows insufficiently privileged users (contributors) to bypass access controls. The vulnerability requires that a user is already authenticated with contributor privileges and exploitable through the affected plugin versions. An attacker with contributor access gains the ability to view or modify restricted revisions and content.

## Affected products

- PublishPress Revisions through 4.2.0

## Timeline

- 2026-10-25: disclosed
- 2026-11-06: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/revisionary/vulnerability/wordpress-publishpress-revisions-plugin-4-2-0-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/revisionary/vulnerability/wordpress-publishpress-revisions-plugin-4-2-0-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [PublishPress Revisions information disclosure via revision-comparison](https://junglewise.ai/threats/cve-2026-118188-the-publishpress-revisions-duplicate-posts-submit-approve-and)
- [PublishPress Revisions Insecure Direct Object Reference in content duplication](https://junglewise.ai/threats/cve-2026-118187-the-publishpress-revisions-duplicate-posts-submit-approve-and)
- [PublishPress Revisions authorization bypass in content publishing](https://junglewise.ai/threats/cve-2026-118186-the-publishpress-revisions-duplicate-posts-submit-approve-and)