CVE-2024-11154

MEDIUM

PublishPress Revisions: Duplicate Posts - Info Disclosure

Title source: llm
STIX 2.1

Description

The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.15 via the 'actAjaxRevisionDiffs' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive data including revisions of posts and pages.

References (4)

Core 4

Scores

CVSS v3 4.3
EPSS 0.0035
EPSS Percentile 27.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-862
Status published
Products (2)
kevinb/PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes < 3.5.15
publishpress/PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes < 3.5.15
Published Nov 20, 2024
Tracked Since Feb 18, 2026