ActivityPub <= 9.4.2 - Unauthenticated Comment Moderation Bypass via Fediverse Handle Spoofing
- ID
- WPSEC-2026-2667
- Plugin
- ActivityPub (activitypub)
- Affected
- all versions before 9.4.3
- Remediation
- Update to 9.4.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-290
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-06
- Attack surface
- ActivityPub on WPSec AttackSurface
- Fix released
- Published
Description
The ActivityPub plugin for WordPress is vulnerable to a comment moderation bypass via the previously approved commenter check in all versions up to, and including, 9.4.2. This is due to the plugin storing a Fediverse commenter's public handle as the comment author email and then letting core's 'previously approved comment' rule match comments that are not Fediverse replies, such as other comment types like product reviews or comments from other protocols, against approved Fediverse comments by author name and email. This makes it possible for unauthenticated attackers to reuse the public display name and handle of a previously approved Fediverse commenter so that their submissions are approved and published without moderation, when the 'Comment author must have a previously approved comment' setting decides moderation.
References
- https://wpsec.com/vuln/WPSEC-2026-2667/
- https://plugins.svn.wordpress.org/activitypub/tags/9.4.3/
- https://wordpress.org/plugins/activitypub/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS