{
 "id": "WPSEC-2026-2667",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2667/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2667/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2667/index.md",
 "title": "ActivityPub <= 9.4.2 - Unauthenticated Comment Moderation Bypass via Fediverse Handle Spoofing",
 "description": "The ActivityPub plugin for WordPress is vulnerable to a comment moderation bypass via the previously approved commenter check in all versions up to, and including, 9.4.2. This is due to the plugin storing a Fediverse commenter's public handle as the comment author email and then letting core's 'previously approved comment' rule match comments that are not Fediverse replies, such as other comment types like product reviews or comments from other protocols, against approved Fediverse comments by author name and email. This makes it possible for unauthenticated attackers to reuse the public display name and handle of a previously approved Fediverse commenter so that their submissions are approved and published without moderation, when the 'Comment author must have a previously approved comment' setting decides moderation.",
 "plugin": {
  "slug": "activitypub",
  "name": "ActivityPub",
  "full_name": "ActivityPub",
  "wordpress_org": "https://wordpress.org/plugins/activitypub/",
  "advisories_url": "https://wpsec.com/vuln/plugin/activitypub/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/activitypub"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-290"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "9.4.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 9.4.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "9.4.3",
 "remediation": "Update to 9.4.3 or later.",
 "fix_released": "2026-11-05T14:32:29+00:00",
 "published": "2026-11-06T14:43:11+00:00",
 "updated": "2026-11-06T11:59:31.073900+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2667/",
  "https://plugins.svn.wordpress.org/activitypub/tags/9.4.3/",
  "https://wordpress.org/plugins/activitypub/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/activitypub",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-06"
 }
}