The vulnerability is a cross‑site request forgery flaw that permits an attacker to send authenticated requests on behalf of a logged‑in user. This can enable the attacker to perform any administrative action that the victim user is authorized to do, such as creating, editing, or deleting content. The weakness is a classic CSRF flaw (CWE‑352).

Any WordPress installation using the PublishPress Revisions plugin version 3.7.22 or earlier is vulnerable. The issue applies to all releases from the plugin’s earliest version up to and including 3.7.22.

The CVSS base score is 5.4, indicating medium risk. The EPSS score is less than 1%, suggesting a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the victim to be logged into WordPress and to be tricked into visiting a crafted URL, so the likely attack vector is a social‑engineering or phishing campaign targeting users with elevated privileges.