Vulnerability · Published Nov 21, 2025 · Assigned by Wordfence
CVE-2025-13149Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification
Medium 4.3
In plain English
A medium-severity missing authorization in Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories from publishpress. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Official description
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the "saveFutureActionData" function in all versions up to, and including, 4.9.1. This makes it possible for authenticated attackers, with author level access and above, to change the status of arbitrary posts and pages via the REST API endpoint.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| publishpress | Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories | 0 – through 4.9.1 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N