# ActivityPub <= 9.4.2 - Unauthenticated Comment Moderation Bypass via Fediverse Handle Spoofing

- **ID:** WPSEC-2026-2667
- **Plugin:** ActivityPub (`activitypub`), https://wordpress.org/plugins/activitypub/
- **Affected versions:** all versions before 9.4.3
- **Fixed in:** 9.4.3 (Update to 9.4.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-290
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-06)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/activitypub
- **Fix released:** 2026-11-05
- **Published:** 2026-11-06
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2667/

## Description

The ActivityPub plugin for WordPress is vulnerable to a comment moderation bypass via the previously approved commenter check in all versions up to, and including, 9.4.2. This is due to the plugin storing a Fediverse commenter's public handle as the comment author email and then letting core's 'previously approved comment' rule match comments that are not Fediverse replies, such as other comment types like product reviews or comments from other protocols, against approved Fediverse comments by author name and email. This makes it possible for unauthenticated attackers to reuse the public display name and handle of a previously approved Fediverse commenter so that their submissions are approved and published without moderation, when the 'Comment author must have a previously approved comment' setting decides moderation.

## References

- https://wpsec.com/vuln/WPSEC-2026-2667/
- https://plugins.svn.wordpress.org/activitypub/tags/9.4.3/
- https://wordpress.org/plugins/activitypub/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2667/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.