Security Alert Summary
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress contains a missing capability check in the getAuthors function. This allows authenticated users with Contributor-level access and above to retrieve email addresses for users who have the edit_posts capability in affected versions.
CVE Details
- CVE ID: CVE-2025-13741
- Affected plugin / component: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress (as described in the CVE)
- Affected versions: All versions up to, and including, 4.9.2
- Published: December 16, 2025 at 12:15:46 PM
- Last modified: December 16, 2025 at 2:10:11 PM
- CVSS v3.1 base score: 4.3 — MEDIUM
- CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Authentication / privileges / user interaction:
- Privileges required: Low (authenticated user with Contributor-level access and above)
- User interaction: None
- Attack vector: Network
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- CWE / weakness: CWE-862
Technical Details
According to the CVE entry, the plugin’s getAuthors function lacks a capability check. Because that check is missing, authenticated users with Contributor-level access and above can call the functionality that returns author information and obtain email addresses for all users who have the edit_posts capability. The issue exists in all versions up to and including 4.9.2 (as stated in the CVE).
The vulnerability is a failure to enforce proper authorization on a server-side function. The CVE does not name additional endpoints or functions beyond getAuthors, nor does it specify any mitigations or fixed versions in the entry.
How This Could Impact Your Website
In a typical small-to-medium WordPress site, you may have a site owner, one or more internal staff members with Editor or Author roles, and external contributors or contractors granted Contributor access. An authenticated contributor could use this vulnerability to retrieve the email addresses of users who can edit posts (for example, editors and authors).
Practical consequences include exposure of internal user email addresses and an increased risk of targeted phishing or social engineering against those users. The impact is limited to the confidentiality of certain user data (email addresses) as described in the CVE; the entry does not indicate integrity or availability impacts.
professional review If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available (the CVE does not specify a fixed version).
- Review and reduce unnecessary user roles and capabilities, especially for Contributors and anyone with access that could enumerate user data.
- Enforce strong passwords and enable two-factor authentication for Editors and Administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, including unexpected API calls or enumeration attempts.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
