Vulnerabilities / ActivityPub / WPSEC-2026-2042
ActivityPub <= 9.3.1 - Authenticated (Author+) Comment Moderation Bypass via Search
Medium 4.3
CWE-862Fixed in 9.4.0
- ID
- WPSEC-2026-2042
- Plugin
- ActivityPub (activitypub)
- Affected
- all versions before 9.4.0
- Remediation
- Update to 9.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- ActivityPub on WPSec AttackSurface
- Fix released
- Published
Description
The ActivityPub plugin for WordPress is vulnerable to a comment moderation bypass via the URL search enhancement in all versions up to, and including, 9.3.1, due to the plugin approving every comment found or imported from a searched URL without checking the moderate_comments capability. This makes it possible for authenticated attackers, with Author-level access and above (any user with the activitypub capability), to publish their own Fediverse replies or approve held and spam Fediverse comments on the site without going through comment moderation.
References
- https://wpsec.com/vuln/WPSEC-2026-2042/
- https://plugins.svn.wordpress.org/activitypub/tags/9.4.0/
- https://wordpress.org/plugins/activitypub/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS