The plugin fails to verify user permissions before permitting workflow management operations. Authenticated users with Contributor-level access and above can create, modify, delete, publish or trash content from any user, including administrators. This provides a direct path to delete legitimate posts, publish malicious content, or otherwise tamper with site content. The weakness maps to CWE‑862, an authorization bypass flaw.

PublishPress’ PublishPress Future plugin for WordPress, versions up to and including 4.9.3. The vulnerability affects all WordPress sites that have this plugin installed via the WordPress plugin repository or other distribution channels.

The CVSS score of 5.4 indicates a moderate severity while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The plugin is not listed in the CISA KEV catalog. The likely attack vector is local: any authenticated contributor or higher who can log into the WordPress admin area can exploit the missing authorization check to manipulate workflow settings and thereby alter content ownership and visibility. No remote code execution or privilege escalation beyond content manipulation is documented in the description.