A Missing Authorization flaw in the PublishPress Revisions plugin lets an attacker view, modify, or delete content revisions that should be protected. The weakness is a classic Authorization bypass (CWE‑862) that can compromise the integrity of site content and enable information disclosure by tampering with historic revisions.

PublishPress Revisions plugin versions from the earliest release through 4.2.0 are affected. All WordPress sites that have installed any of those releases are at risk until the plugin is upgraded to 4.3.1 or later.

The CVSS score of 4.3 indicates low severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote web request to a plugin endpoint that performs revision operations without checking the user’s capabilities; this inference comes from the description that states the flaw allows exploitation of incorrectly configured access control levels.