# Co-Authors Plus <= 4.1.3 - Authenticated (Contributor+) Missing Authorization to Guest Author Creation and Modification

- **ID:** WPSEC-2026-2328
- **Plugin:** Co-Authors Plus (`co-authors-plus`), https://wordpress.org/plugins/co-authors-plus/
- **Affected versions:** from 3.0 before 4.2.0
- **Fixed in:** 4.2.0 (Update to 4.2.0 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/co-authors-plus
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2328/

## Description

The Co-Authors Plus plugin for WordPress is vulnerable to unauthorized modification of data via the guest author profile screens, the guest author custom fields and the '/wp/v2/guest-author' REST route in all versions up to, and including, 4.1.3, due to the guest-author post type being registered with the default post capabilities instead of the 'list_users' capability required by the Guest Authors screen, and to slug collision checks that only covered existing guest authors and users who are members of the current site. This makes it possible for authenticated attackers, with contributor-level access and above, to create and edit guest author profiles, including setting the guest author's linked account through WordPress's generic custom field handling, and to create a guest author whose slug matches a WordPress user who is not a member of the current site, so that the user's bylines resolve to the attacker-controlled profile. Editors could additionally edit and delete any guest author.

## References

- https://wpsec.com/vuln/WPSEC-2026-2328/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.2.0/
- https://wordpress.org/plugins/co-authors-plus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2328/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.