CVE-2021-24783: Post Expirator < 2.6.0 - Contributor+ Arbitrary Post Schedule Deletion

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-11-08 · updated 2026-06-17
Weakness: CWE-863

Description

The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.

Affected products

PublishPress Post Expirator: before 2.6.0 — fixed in 2.6.0

How to fix

Upgrade to a fixed version: PublishPress Post Expirator 2.6.0. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/de51b970-ab13-41a6-a479-a92cd0e70b71
https://wpscan.com/vulnerability/de51b970-ab13-41a6-a479-a92cd0e70b71

Get alerted when CVE-2021-24783 or the next vulnerability affects your stack