# Co-Authors Plus <= 4.1.1 - Authenticated (Editor+) Insecure Direct Object Reference to Post Co-Author Modification

- **ID:** WPSEC-2026-1478
- **Plugin:** Co-Authors Plus (`co-authors-plus`), https://wordpress.org/plugins/co-authors-plus/
- **Affected versions:** from 3.5 before 4.1.2
- **Fixed in:** 4.1.2 (Update to 4.1.2 or later.)
- **Severity:** Low 3.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/co-authors-plus
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1478/

## Description

The Co-Authors Plus plugin for WordPress is vulnerable to Insecure Direct Object Reference via the coauthors/v1 REST endpoints for reading and updating a post's co-authors and via the bulk edit co-author handler in versions 3.5 up to, and including, 4.1.1. This is because these paths only checked whether the user could assign authors in general, not whether the user could edit the specific post. Bulk edit also applied co-authors to submitted posts that WordPress core had skipped. This makes it possible for authenticated attackers who can assign authors (by default users with the edit_others_posts capability, such as Editors) to read and replace the co-authors, and with them the post_author, of posts they are not allowed to edit.

## References

- https://wpsec.com/vuln/WPSEC-2026-1478/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.1.2/
- https://wordpress.org/plugins/co-authors-plus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1478/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.