{
 "id": "WPSEC-2026-2532",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2532/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2532/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2532/index.md",
 "title": "Co-Authors Plus <= 4.2.0 - Unauthenticated Sensitive Information Exposure via Co-Author Export File",
 "description": "The Co-Authors Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.0 due to the 'wp co-authors-plus export-coauthors' WP-CLI command writing its output by default to a predictable, web-accessible location (wp-content/cap-coauthors-export.json). This makes it possible for unauthenticated attackers to download the file and obtain guest author email addresses and the slugs of unpublished posts, provided an administrator has run the export command without specifying a --file path.",
 "plugin": {
  "slug": "co-authors-plus",
  "name": "Co-Authors Plus",
  "full_name": "Co-Authors Plus",
  "wordpress_org": "https://wordpress.org/plugins/co-authors-plus/",
  "advisories_url": "https://wpsec.com/vuln/plugin/co-authors-plus/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/co-authors-plus"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-552"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.2.0",
    "from_inclusive": true,
    "to": "4.2.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.2.0 before 4.2.1"
  ]
 },
 "introduced_in": "4.2.0",
 "fixed_in": "4.2.1",
 "remediation": "Update to 4.2.1 or later.",
 "fix_released": "2026-11-04T00:32:10+00:00",
 "published": "2026-11-05T00:45:48+00:00",
 "updated": "2026-11-04T13:57:35.503371+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2532/",
  "https://plugins.svn.wordpress.org/co-authors-plus/tags/4.2.1/",
  "https://wordpress.org/plugins/co-authors-plus/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/co-authors-plus",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "None seen",
  "as_of": "2026-11-04"
 }
}