ActivityPub <= 9.3.1 - Unauthenticated Authentication Bypass via Incoming Activity Signature Verification
- ID
- WPSEC-2026-2044
- Plugin
- ActivityPub (activitypub)
- Affected
- all versions before 9.4.0
- Remediation
- Update to 9.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-290
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- ActivityPub on WPSec AttackSurface
- Fix released
- Published
Description
The ActivityPub plugin for WordPress is vulnerable to Authentication Bypass via incoming activity signature verification in all versions up to, and including, 9.3.1, due to the plugin only checking that the signing key and the activity's actor are on the same host, without checking that the key belongs to that actor. This makes it possible for unauthenticated attackers who can sign with a key served from the same server as the account they impersonate, for example on a server where users hold their own keys, to send activities, such as replies, likes, updates, undos or follows, that are processed as if another account on the same server had sent them.
References
- https://wpsec.com/vuln/WPSEC-2026-2044/
- https://plugins.svn.wordpress.org/activitypub/tags/9.4.0/
- https://wordpress.org/plugins/activitypub/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS