Vulnerabilities / Co-Authors Plus / WPSEC-2026-2532
Co-Authors Plus <= 4.2.0 - Unauthenticated Sensitive Information Exposure via Co-Author Export File
Low 3.7
CWE-552Fixed in 4.2.1
- ID
- WPSEC-2026-2532
- Plugin
- Co-Authors Plus (co-authors-plus)
- Affected
- from 4.2.0 before 4.2.1
- Remediation
- Update to 4.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-552
- Usage
- Plugin Medium · Affected versions None seen among sites WPSec scans, 2026-11-04
- Attack surface
- Co-Authors Plus on WPSec AttackSurface
- Fix released
- Published
Description
The Co-Authors Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.0 due to the 'wp co-authors-plus export-coauthors' WP-CLI command writing its output by default to a predictable, web-accessible location (wp-content/cap-coauthors-export.json). This makes it possible for unauthenticated attackers to download the file and obtain guest author email addresses and the slugs of unpublished posts, provided an administrator has run the export command without specifying a --file path.
References
- https://wpsec.com/vuln/WPSEC-2026-2532/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.2.1/
- https://wordpress.org/plugins/co-authors-plus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS