{
 "id": "WPSEC-2026-2044",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2044/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2044/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2044/index.md",
 "title": "ActivityPub <= 9.3.1 - Unauthenticated Authentication Bypass via Incoming Activity Signature Verification",
 "description": "The ActivityPub plugin for WordPress is vulnerable to Authentication Bypass via incoming activity signature verification in all versions up to, and including, 9.3.1, due to the plugin only checking that the signing key and the activity's actor are on the same host, without checking that the key belongs to that actor. This makes it possible for unauthenticated attackers who can sign with a key served from the same server as the account they impersonate, for example on a server where users hold their own keys, to send activities, such as replies, likes, updates, undos or follows, that are processed as if another account on the same server had sent them.",
 "plugin": {
  "slug": "activitypub",
  "name": "ActivityPub",
  "full_name": "ActivityPub",
  "wordpress_org": "https://wordpress.org/plugins/activitypub/",
  "advisories_url": "https://wpsec.com/vuln/plugin/activitypub/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/activitypub"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-290"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.4.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.4.0",
 "remediation": "Update to 9.4.0 or later.",
 "fix_released": "2026-10-29T10:30:37+00:00",
 "published": "2026-10-30T10:50:10+00:00",
 "updated": "2026-10-29T17:47:21.333035+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2044/",
  "https://plugins.svn.wordpress.org/activitypub/tags/9.4.0/",
  "https://wordpress.org/plugins/activitypub/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/activitypub",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}