Co-Authors Plus <= 4.1.3 - Authenticated (Contributor+) Missing Authorization to Guest Author Creation and Modification
- ID
- WPSEC-2026-2328
- Plugin
- Co-Authors Plus (co-authors-plus)
- Affected
- from 3.0 before 4.2.0
- Remediation
- Update to 4.2.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-03
- Attack surface
- Co-Authors Plus on WPSec AttackSurface
- Fix released
- Published
Description
The Co-Authors Plus plugin for WordPress is vulnerable to unauthorized modification of data via the guest author profile screens, the guest author custom fields and the '/wp/v2/guest-author' REST route in all versions up to, and including, 4.1.3, due to the guest-author post type being registered with the default post capabilities instead of the 'list_users' capability required by the Guest Authors screen, and to slug collision checks that only covered existing guest authors and users who are members of the current site. This makes it possible for authenticated attackers, with contributor-level access and above, to create and edit guest author profiles, including setting the guest author's linked account through WordPress's generic custom field handling, and to create a guest author whose slug matches a WordPress user who is not a member of the current site, so that the user's bylines resolve to the attacker-controlled profile. Editors could additionally edit and delete any guest author.
References
- https://wpsec.com/vuln/WPSEC-2026-2328/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.2.0/
- https://wordpress.org/plugins/co-authors-plus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS