CVE-2021-24783: Publishpress Post Expirator

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.

Affected products

• Publishpress Post Expirator: before 2.6.0 (fixed in 2.6.0)

Published 2021-11-08. Last modified 2026-06-17.