# Co-Authors Plus <= 4.2.0 - Unauthenticated Sensitive Information Exposure via Co-Author Export File

- **ID:** WPSEC-2026-2532
- **Plugin:** Co-Authors Plus (`co-authors-plus`), https://wordpress.org/plugins/co-authors-plus/
- **Affected versions:** from 4.2.0 before 4.2.1
- **Fixed in:** 4.2.1 (Update to 4.2.1 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-552
- **Usage among sites WPSec scans:** plugin Medium, affected versions None seen (as of 2026-11-04)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/co-authors-plus
- **Fix released:** 2026-11-04
- **Published:** 2026-11-05
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2532/

## Description

The Co-Authors Plus plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.0 due to the 'wp co-authors-plus export-coauthors' WP-CLI command writing its output by default to a predictable, web-accessible location (wp-content/cap-coauthors-export.json). This makes it possible for unauthenticated attackers to download the file and obtain guest author email addresses and the slugs of unpublished posts, provided an administrator has run the export command without specifying a --file path.

## References

- https://wpsec.com/vuln/WPSEC-2026-2532/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.2.1/
- https://wordpress.org/plugins/co-authors-plus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2532/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.