{
 "id": "WPSEC-2026-2330",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2330/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2330/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2330/index.md",
 "title": "Co-Authors Plus <= 4.1.3 - Unauthenticated Sensitive Information Exposure via '/wp/v2/coauthors' REST Route",
 "description": "The Co-Authors Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.1.3 via the '/wp/v2/coauthors' REST route. The author taxonomy was exposed through the default core terms controller without any permission check, and author term names are user logins. This makes it possible for unauthenticated attackers to enumerate the login names of users on the site, which WordPress core otherwise keeps out of anonymous REST responses.",
 "plugin": {
  "slug": "co-authors-plus",
  "name": "Co-Authors Plus",
  "full_name": "Co-Authors Plus",
  "wordpress_org": "https://wordpress.org/plugins/co-authors-plus/",
  "advisories_url": "https://wpsec.com/vuln/plugin/co-authors-plus/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/co-authors-plus"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "3.5",
    "from_inclusive": true,
    "to": "4.2.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 3.5 before 4.2.0"
  ]
 },
 "introduced_in": "3.5",
 "fixed_in": "4.2.0",
 "remediation": "Update to 4.2.0 or later.",
 "fix_released": "2026-10-30T12:24:03+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:39:16.220853+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2330/",
  "https://plugins.svn.wordpress.org/co-authors-plus/tags/4.2.0/",
  "https://wordpress.org/plugins/co-authors-plus/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/co-authors-plus",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}