The vulnerability is a missing capability check in the getAuthors function of the PublishPress Future plugin, which enables authenticated users with Contributor-level access or higher to read the email addresses of all users who have the edit_posts capability. This flaw does not allow code execution or other destructive actions, but it does expose personally identifiable information that could be used for phishing or social engineering attacks.

The affected system is any WordPress site running the PublishPress Future plugin on versions up to and including 4.9.2, such as sites using the Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories module.

The CVSS score is 4.3, indicating a moderate severity. The EPSS score of less than 1% suggests a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need only Contributor-level or higher access on the affected WordPress installation; no external exploitation vector is required. Therefore the risk is limited to sites where users with such roles exist and may be exploitable if those accounts are compromised.