{
 "id": "WPSEC-2026-2042",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2042/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2042/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2042/index.md",
 "title": "ActivityPub <= 9.3.1 - Authenticated (Author+) Comment Moderation Bypass via Search",
 "description": "The ActivityPub plugin for WordPress is vulnerable to a comment moderation bypass via the URL search enhancement in all versions up to, and including, 9.3.1, due to the plugin approving every comment found or imported from a searched URL without checking the moderate_comments capability. This makes it possible for authenticated attackers, with Author-level access and above (any user with the activitypub capability), to publish their own Fediverse replies or approve held and spam Fediverse comments on the site without going through comment moderation.",
 "plugin": {
  "slug": "activitypub",
  "name": "ActivityPub",
  "full_name": "ActivityPub",
  "wordpress_org": "https://wordpress.org/plugins/activitypub/",
  "advisories_url": "https://wpsec.com/vuln/plugin/activitypub/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/activitypub"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.4.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.4.0",
 "remediation": "Update to 9.4.0 or later.",
 "fix_released": "2026-10-29T10:30:37+00:00",
 "published": "2026-10-30T10:50:10+00:00",
 "updated": "2026-10-29T17:47:21.333035+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2042/",
  "https://plugins.svn.wordpress.org/activitypub/tags/9.4.0/",
  "https://wordpress.org/plugins/activitypub/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/activitypub",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}