Unauthorized Data Modification in PublishPress Future Plugin for WordPress
CVE-2025-13149
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 November 2025
What is CVE-2025-13149?
The PublishPress Future plugin for WordPress is susceptible to unauthorized data modification due to a lack of proper authorization checks in the 'saveFutureActionData' function. This vulnerability affects all versions up to and including 4.9.1, and allows attackers with author-level access or higher to manipulate the statuses of posts and pages through the REST API endpoint. This can lead to significant risks in content integrity and management within WordPress sites.
Affected Version(s)
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories * <= 4.9.1