# Co-Authors Plus <= 4.1.2 - Authenticated (Contributor+) Sensitive Information Exposure via REST API Author Term Descriptions

- **ID:** WPSEC-2026-1745
- **Plugin:** Co-Authors Plus (`co-authors-plus`), https://wordpress.org/plugins/co-authors-plus/
- **Affected versions:** from 3.5 before 4.1.3
- **Fixed in:** 4.1.3 (Update to 4.1.3 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Medium, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/co-authors-plus
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1745/

## Description

The Co-Authors Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.2 via the author taxonomy term descriptions returned by the REST API. The descriptions contain co-author email addresses and were shown to any user with the edit_posts capability instead of only users who can list users. This makes it possible for authenticated attackers with Contributor-level access and above to obtain the email addresses of site authors.

## References

- https://wpsec.com/vuln/WPSEC-2026-1745/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.1.3/
- https://wordpress.org/plugins/co-authors-plus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1745/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.