CVE-2023-44151 is a medium severity (CVSS 5.4) missing authorization flaw in the Pre-Publish Checklist plugin for WordPress from Brainstorm Force, in versions up to and including 1.1.1. Patchstack lists 1.1.2 as the fixed version, so update to 1.1.2 or later.
What's affected
The record lists the Pre-Publish Checklist plugin from Brainstorm Force through version 1.1.1. The Patchstack entry says the same and names 1.1.2 as the fixed version. Patchstack describes the problem as broken access control and says a Contributor level account is required.
The record scores 5.4 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L: network reachable, low privileges, with a low impact on integrity and availability. Patchstack lists its own priority as Low and describes exploitation as unlikely. Those two statements fit together. The CVSS score reflects technical impact and the Patchstack priority reflects expected real world risk.
The weakness is CWE-862, missing authorization. The record does not mark the CVE as known exploited.
How to check if you're exposed
- In the WordPress admin, open Plugins, Installed Plugins and find Pre-Publish Checklist. Read the version number.
- If you use the command line,
wp plugin listshows plugin versions and which have updates. - Versions up to and including 1.1.1 are affected.
- Review your user list for Contributor accounts and note who they belong to, since the flaw requires one.
Safeguard offers a free in-browser dependency scan at gold.safeguard.sh/scan. It reads package manifests, so it will not see installed desktop software or device firmware, but it covers the open source dependencies in your own code.
What to do now
- Update the Pre-Publish Checklist plugin to version 1.1.2 or later.
- If you do not use the plugin, deactivate and delete it.
- Review users with the Contributor role and remove accounts that are not needed.
- Turn on automatic plugin updates for plugins from reputable vendors if your change process allows it.
- If you cannot update, ask your host or developer for help, as Patchstack advises.
Why it matters
Missing authorization means the plugin does not check whether the current user is allowed to perform an action before doing it. A user with a low role can then call features meant for editors or administrators.
The damage here is limited, which is why the score is medium. A Contributor can only act in the ways the plugin exposes. The lesson applies more widely. Every plugin action that changes data should check capabilities on the server, not just hide a button in the interface.
Quick check
Do I need to worry if I have no Contributor users?
The risk is lower, because the attack needs at least a Contributor account. Still update, since accounts can be registered or compromised.
Which version fixes it?
Version 1.1.2, according to Patchstack.
Sources
Last reviewed: 19 October 2026.
