Publishpress Authors CVE-2026-25309

Remote unauthenticated attacker can exploit PublishPress Authors plugin <= 4.10.1 when installed on WordPress. No victim interaction required. Affects default configurations where access control is improperly configured or missing authorization checks on sensitive operations.

While specific CVSS vector data is not available in the provided intelligence, the vulnerability is reported as a missing authorization/broken access control issue, which typically carries moderate to high severity in real-world contexts. The absence of a CVSS score, EPSS probability score, and KEV (Known Exploited Vulnerability) status limits definitive risk quantification; however, the fact that it was reported by Patchstack and assigned an ENISA EUVD ID (EUVD-2026-15639) indicates formal recognition. Authentication bypass and access control vulnerabilities are generally considered exploitable with low complexity once discovered. Without confirmation of active exploitation, public POC availability, or automatable attack vectors, this should be prioritized as a medium-to-high severity issue requiring timely patching, particularly for WordPress installations with sensitive author management requirements.

An authenticated WordPress user with limited permissions (such as a contributor) could exploit the misconfigured access control to view, modify, or delete author information belonging to other users, potentially escalating their privileges or tampering with content attribution. An unauthenticated attacker might be able to access the plugin's exposed endpoints if the authorization checks are entirely absent, allowing reconnaissance or direct manipulation of author data. The low attack complexity of access control bypasses means that exploitation could occur through simple HTTP requests once the vulnerable endpoint is identified.