CVE-2025-13149: WordPress PublishPress Future Auth Bypass

CVE-2025-13149 Overview

CVE-2025-13149 affects the PublishPress Future plugin for WordPress, which schedules post changes such as unpublish, delete, status change, trash, and category modifications. The plugin contains a missing authorization check in the saveFutureActionData function across all versions up to and including 4.9.1. Authenticated users with author-level access or higher can invoke a REST API endpoint to modify the status of arbitrary posts and pages. The flaw is tracked under CWE-862: Missing Authorization.

Critical Impact
Authenticated attackers with author privileges can alter the publication status of any post or page on the site, enabling content tampering and workflow disruption.

Affected Products

PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress
All versions up to and including 4.9.1
WordPress sites exposing the plugin's REST API endpoint to author-level accounts

Discovery Timeline

2025-11-21 - CVE-2025-13149 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13149

Vulnerability Analysis

The vulnerability resides in the saveFutureActionData function, which handles scheduled future actions for WordPress posts and pages. The function is reachable through a REST API endpoint but does not verify that the calling user is authorized to modify the target post. Any authenticated user granted the author capability or higher can issue REST requests that update the future action data of posts they do not own. Because the plugin executes those scheduled changes, an attacker can effectively alter the publication status of arbitrary content, including posts owned by editors or administrators.

Root Cause

The root cause is a missing authorization check [CWE-862] in the saveFutureActionData handler. The endpoint validates authentication but does not confirm the caller has edit_post capability for the specified post ID. Object-level authorization checks (current_user_can( 'edit_post', $post_id )) were absent, allowing horizontal privilege escalation across posts.

Attack Vector

Exploitation requires a valid WordPress account with author-level access. The attacker sends a crafted REST API request referencing a post ID they do not own and supplies future action parameters that change the post's status, for example transitioning a published post to draft or trash. No user interaction is required from the victim, and the network-based attack complexity is low.

The upstream fix landed in the PublishPress Future 4.9.2 release. The commit metadata (release/4.9.2) confirms the corrective patch:

text

Merge pull request #1495 from publishpress/release/4.9.2
# Adds authorization enforcement around saveFutureActionData
# and REST endpoint capability checks.

Source: PublishPress Future GitHub Commit

Detection Methods for CVE-2025-13149

Indicators of Compromise

Unexpected status transitions on posts or pages, including published content moved to draft, pending, or trash without an audit trail from the owning author.
REST API requests from author-level accounts targeting the PublishPress Future action endpoints with post_id values outside the caller's authored content.
Scheduled future actions appearing on posts the author user does not own.

Detection Strategies

Enable WordPress audit logging to correlate REST API calls against user capabilities and target post ownership.
Alert on REST requests to PublishPress Future endpoints where the authenticated user is not the post author and lacks editor-level roles.
Review web server access logs for POST requests to /wp-json/ routes exposed by the plugin originating from lower-privilege accounts.

Monitoring Recommendations

Track post status change events (transition_post_status) and compare the initiating user against the post owner.
Baseline normal author activity and flag anomalous bulk modifications across posts an account did not create.
Monitor for creation of PublishPress Future scheduled actions immediately followed by unexpected content state changes.

How to Mitigate CVE-2025-13149

Immediate Actions Required

Update the PublishPress Future plugin to version 4.9.2 or later on all WordPress installations.
Audit existing author-level and contributor-level accounts, removing dormant or unnecessary users.
Review recent post status changes and scheduled future actions for unauthorized modifications.

Patch Information

The issue is resolved in PublishPress Future version 4.9.2. The fix is included in the release documented at the PublishPress Future GitHub Commit and detailed in the Wordfence Vulnerability Report. Site operators should apply the update through the WordPress plugin manager or WP-CLI.

Workarounds

Temporarily deactivate the PublishPress Future plugin until the 4.9.2 update is applied.
Restrict author-level account creation and require administrator approval for new contributors.
Deploy a web application firewall rule to block REST requests to PublishPress Future endpoints from non-editor accounts.

bash

# Update the plugin using WP-CLI
wp plugin update post-expirator --version=4.9.2

# Verify the installed version
wp plugin get post-expirator --field=version

# Optional: temporarily deactivate until patched
wp plugin deactivate post-expirator