Cross-Site Request Forgery in PublishPress Revisions Plugin by PublishPress
CVE-2026-25322

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
PublisHPress Revisions
Vendor
CVE Published:
19 February 2026

What is CVE-2026-25322?

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the PublishPress Revisions plugin, allowing attackers to exploit the plugin's functionality. This flaw enables unauthorized actions to be performed on behalf of authenticated users without their consent. The vulnerability impacts versions up to and including 3.7.22, potentially compromising the integrity of user actions and data. Website administrators are strongly encouraged to update their plugins to mitigate this security risk.

Affected Version(s)

PublishPress Revisions 0 <= 3.7.22

References

https://patchstack.com/database/Wordpress/Plugin/revision...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lilmingwa13 | Patchstack Bug Bounty Program
.