WordPress Schedule Post Changes With PublishPress Future Plugin Authorization Bypass Vulnerability

A vulnerability exists in the Schedule Post Changes With PublishPress Future plugin for WordPress, affecting all versions through 4.9.3. The issue stems from the plugin's failure to properly verify user authorization, allowing authenticated attackers with Contributor-level access or higher to manipulate workflows. This includes creating, updating, deleting, and publishing workflows that could automatically remove posts upon publication or update, even those authored by administrators.

Impact

Exploitation of this vulnerability could lead to unauthorized manipulation of post workflows, including the deletion of posts, potentially those created by administrators.

Remediation

Users are advised to update the plugin to version 4.9.4 or a newer patched version.