Vulnerabilities / Co-Authors Plus / WPSEC-2026-1745
Co-Authors Plus <= 4.1.2 - Authenticated (Contributor+) Sensitive Information Exposure via REST API Author Term Descriptions
Medium 4.3
CWE-200Fixed in 4.1.3
- ID
- WPSEC-2026-1745
- Plugin
- Co-Authors Plus (co-authors-plus)
- Affected
- from 3.5 before 4.1.3
- Remediation
- Update to 4.1.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Co-Authors Plus on WPSec AttackSurface
- Fix released
- Published
Description
The Co-Authors Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.2 via the author taxonomy term descriptions returned by the REST API. The descriptions contain co-author email addresses and were shown to any user with the edit_posts capability instead of only users who can list users. This makes it possible for authenticated attackers with Contributor-level access and above to obtain the email addresses of site authors.
References
- https://wpsec.com/vuln/WPSEC-2026-1745/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.1.3/
- https://wordpress.org/plugins/co-authors-plus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS