# ActivityPub <= 9.3.1 - Unauthenticated Authentication Bypass via Incoming Activity Signature Verification

- **ID:** WPSEC-2026-2044
- **Plugin:** ActivityPub (`activitypub`), https://wordpress.org/plugins/activitypub/
- **Affected versions:** all versions before 9.4.0
- **Fixed in:** 9.4.0 (Update to 9.4.0 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-290
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/activitypub
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2044/

## Description

The ActivityPub plugin for WordPress is vulnerable to Authentication Bypass via incoming activity signature verification in all versions up to, and including, 9.3.1, due to the plugin only checking that the signing key and the activity's actor are on the same host, without checking that the key belongs to that actor. This makes it possible for unauthenticated attackers who can sign with a key served from the same server as the account they impersonate, for example on a server where users hold their own keys, to send activities, such as replies, likes, updates, undos or follows, that are processed as if another account on the same server had sent them.

## References

- https://wpsec.com/vuln/WPSEC-2026-2044/
- https://plugins.svn.wordpress.org/activitypub/tags/9.4.0/
- https://wordpress.org/plugins/activitypub/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2044/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.