Vulnerabilities / ActivityPub / WPSEC-2026-2043
ActivityPub <= 9.3.1 - Unauthenticated Missing Authorization to Federated Comment Modification via Update and Undo Activities
Medium 5.3
CWE-862Fixed in 9.4.0
- ID
- WPSEC-2026-2043
- Plugin
- ActivityPub (activitypub)
- Affected
- all versions before 9.4.0
- Remediation
- Update to 9.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- ActivityPub on WPSec AttackSurface
- Fix released
- Published
Description
The ActivityPub plugin for WordPress is vulnerable to unauthorized modification of data via incoming Update and Undo activities in all versions up to, and including, 9.3.1, due to a missing ownership check for federated comments and received activities that have no remote actor recorded. This makes it possible for unauthenticated attackers who control a Fediverse account to overwrite the content of other users' federated comments, or undo their likes and reposts, when those items were received before the plugin started recording who sent them.
References
- https://wpsec.com/vuln/WPSEC-2026-2043/
- https://plugins.svn.wordpress.org/activitypub/tags/9.4.0/
- https://wordpress.org/plugins/activitypub/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS