{
 "id": "WPSEC-2026-1745",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1745/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1745/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1745/index.md",
 "title": "Co-Authors Plus <= 4.1.2 - Authenticated (Contributor+) Sensitive Information Exposure via REST API Author Term Descriptions",
 "description": "The Co-Authors Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.2 via the author taxonomy term descriptions returned by the REST API. The descriptions contain co-author email addresses and were shown to any user with the edit_posts capability instead of only users who can list users. This makes it possible for authenticated attackers with Contributor-level access and above to obtain the email addresses of site authors.",
 "plugin": {
  "slug": "co-authors-plus",
  "name": "Co-Authors Plus",
  "full_name": "Co-Authors Plus",
  "wordpress_org": "https://wordpress.org/plugins/co-authors-plus/",
  "advisories_url": "https://wpsec.com/vuln/plugin/co-authors-plus/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/co-authors-plus"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.5",
    "from_inclusive": true,
    "to": "4.1.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.5 before 4.1.3"
  ]
 },
 "introduced_in": "3.5",
 "fixed_in": "4.1.3",
 "remediation": "Update to 4.1.3 or later.",
 "fix_released": "2026-10-26T12:31:54+00:00",
 "published": "2026-10-27T13:53:32+00:00",
 "updated": "2026-10-27T13:39:31.680937+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1745/",
  "https://plugins.svn.wordpress.org/co-authors-plus/tags/4.1.3/",
  "https://wordpress.org/plugins/co-authors-plus/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/co-authors-plus",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}