{
 "id": "WPSEC-2026-2043",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2043/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2043/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2043/index.md",
 "title": "ActivityPub <= 9.3.1 - Unauthenticated Missing Authorization to Federated Comment Modification via Update and Undo Activities",
 "description": "The ActivityPub plugin for WordPress is vulnerable to unauthorized modification of data via incoming Update and Undo activities in all versions up to, and including, 9.3.1, due to a missing ownership check for federated comments and received activities that have no remote actor recorded. This makes it possible for unauthenticated attackers who control a Fediverse account to overwrite the content of other users' federated comments, or undo their likes and reposts, when those items were received before the plugin started recording who sent them.",
 "plugin": {
  "slug": "activitypub",
  "name": "ActivityPub",
  "full_name": "ActivityPub",
  "wordpress_org": "https://wordpress.org/plugins/activitypub/",
  "advisories_url": "https://wpsec.com/vuln/plugin/activitypub/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/activitypub"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.4.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.4.0",
 "remediation": "Update to 9.4.0 or later.",
 "fix_released": "2026-10-29T10:30:37+00:00",
 "published": "2026-10-30T10:50:10+00:00",
 "updated": "2026-10-29T17:47:21.333035+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2043/",
  "https://plugins.svn.wordpress.org/activitypub/tags/9.4.0/",
  "https://wordpress.org/plugins/activitypub/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/activitypub",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}