# ActivityPub <= 9.3.1 - Authenticated (Author+) Comment Moderation Bypass via Search

- **ID:** WPSEC-2026-2042
- **Plugin:** ActivityPub (`activitypub`), https://wordpress.org/plugins/activitypub/
- **Affected versions:** all versions before 9.4.0
- **Fixed in:** 9.4.0 (Update to 9.4.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/activitypub
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2042/

## Description

The ActivityPub plugin for WordPress is vulnerable to a comment moderation bypass via the URL search enhancement in all versions up to, and including, 9.3.1, due to the plugin approving every comment found or imported from a searched URL without checking the moderate_comments capability. This makes it possible for authenticated attackers, with Author-level access and above (any user with the activitypub capability), to publish their own Fediverse replies or approve held and spam Fediverse comments on the site without going through comment moderation.

## References

- https://wpsec.com/vuln/WPSEC-2026-2042/
- https://plugins.svn.wordpress.org/activitypub/tags/9.4.0/
- https://wordpress.org/plugins/activitypub/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2042/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.