CVE-2026-25330: 
WordPress vulnerability analysis and mitigation

CVE-2026-25330 is a Missing Authorization (Broken Access Control) vulnerability in the PublishPress Authors WordPress plugin. It affects all versions up to and including 4.10.1, allowing low-privileged authenticated users (Contributor level) to perform actions beyond their intended access level. The vulnerability was reported on January 7, 2026, and published on February 6, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack, Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the appropriate permissions before executing certain privileged actions. The attack vector is network-based, requiring low privileges (Contributor-level WordPress account) and no user interaction. The flaw stems from missing or incorrectly configured access control checks on one or more plugin functions, enabling exploitation of incorrectly configured access control security levels (Patchstack, Feedly).

Successful exploitation results in a low integrity impact with no confidentiality or availability impact, meaning an attacker can perform unauthorized write or modification actions within the WordPress site but cannot read sensitive data or disrupt service. An authenticated user with Contributor-level access could execute higher-privileged actions within the PublishPress Authors plugin, potentially manipulating author assignments or related content settings. The scope is limited to the affected WordPress installation (Patchstack).

The vulnerability requires a low-privilege authenticated account (Contributor role) and has no public exploit code or known in-the-wild exploitation reported at this time. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites at scale, though this specific instance is rated low priority (Patchstack, Feedly).

The vulnerability is patched in PublishPress Authors version 4.11.0. Site administrators should update the plugin to version 4.11.0 or later immediately. If an immediate update is not possible, restricting Contributor-level user registration or disabling the plugin temporarily is advisable. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was discovered and reported by security researcher johska through Patchstack's Active Vulnerability Disclosure Program (VDP) on January 7, 2026, and publicly disclosed on February 6, 2026. No significant broader media coverage or notable community commentary has been identified beyond the Patchstack advisory (Patchstack).