WordPress PublishPress Future Plugin Schedule Post Changes Unauthorized Data Modification Vulnerability

A vulnerability exists in the WordPress PublishPress Future plugin, specifically in the Schedule Post Changes feature, versions through 4.9.1. The issue arises from a missing authorization check in the 'saveFutureActionData' function, allowing authenticated attackers with author-level access or higher to unauthorizedly modify the status of posts and pages. This exploitation can be carried out through the REST API endpoint.

Impact

Exploitation of this vulnerability allows for unauthorized modification of post and page statuses, potentially leading to unauthorized content management actions such as unpublishing, deleting, or changing categories of posts and pages.

Remediation

Users are advised to update the PublishPress Future plugin to version 4.9.2 or later.