PublishPress Permissions CVE-2026-84771

No authentication is required (PR:N, UI:N per CVSS). The site must have PublishPress Permissions <= 4.8.3 installed and active, and must be using the plugin to restrict access to specific posts or objects (i.e., some content must be permission-gated for the disclosure to have meaningful impact). Exploitation is limited to read-only information disclosure (C:L); no write or admin actions are possible through this flaw. Sites where all content is already publicly accessible gain no practical protection from the plugin and are unaffected in practice.

CVSS 5.3 with AV:N/AC:L/PR:N/UI:N reflects a straightforward unauthenticated network-exploitable flaw requiring no special conditions. However, impact is limited to C:L - partial information disclosure of permission-restricted content - with no write or destructive capability. No EPSS data is provided and the vulnerability is not in CISA KEV, so opportunistic mass exploitation is not evidenced. The risk is moderate for WordPress deployments specifically relying on PublishPress Permissions to gate sensitive content (e.g., membership sites, internal editorial workflows): an attacker can read content that should be access-controlled, potentially exposing drafts, private posts, or subscriber-only material. For sites where all content is already public, the practical risk is negligible. No conflicting signals in the data.

An unauthenticated attacker sends HTTP requests to a WordPress site running PublishPress Permissions, cycling through predictable post or object IDs (e.g., ?p=101, ?p=102) in parameters the plugin uses for access-controlled lookups. Because the plugin fails to verify the requester's permissions against the supplied ID, responses return content - such as private editorial drafts or subscriber-only posts - that should be restricted.