Co-Authors Plus <= 4.1.1 - Authenticated (Editor+) Insecure Direct Object Reference to Post Co-Author Modification
- ID
- WPSEC-2026-1478
- Plugin
- Co-Authors Plus (co-authors-plus)
- Affected
- from 3.5 before 4.1.2
- Remediation
- Update to 4.1.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Co-Authors Plus on WPSec AttackSurface
- Fix released
- Published
Description
The Co-Authors Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference via the coauthors/v1 REST endpoints for reading and updating a post's co-authors and via the bulk edit co-author handler in versions 3.5 up to, and including, 4.1.1. This is because these paths only checked whether the user could assign authors in general, not whether the user could edit the specific post. Bulk edit also applied co-authors to submitted posts that WordPress core had skipped. This makes it possible for authenticated attackers who can assign authors (by default users with the edit_others_posts capability, such as Editors) to read and replace the co-authors, and with them the post_author, of posts they are not allowed to edit.
References
- https://wpsec.com/vuln/WPSEC-2026-1478/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.1.2/
- https://wordpress.org/plugins/co-authors-plus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS