Co-Authors Plus <= 4.2.1 - Authenticated (Contributor+) Missing Authorization to Post Author Change
- ID
- WPSEC-2026-2746
- Plugin
- Co-Authors Plus (co-authors-plus)
- Affected
- all versions before 4.2.2
- Remediation
- Update to 4.2.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-08
- Attack surface
- Co-Authors Plus on WPSec AttackSurface
- Fix released
- Published
Description
The Co-Authors Plus plugin for WordPress is vulnerable to unauthorized modification of data via the post 'author' field of REST API and classic editor saves in all versions up to, and including, 4.2.1, due to the plugin skipping the re-derivation of post_author from the post's author terms on every REST save and on classic saves that carry co-author form fields, even when those fields fail the nonce or capability check. This makes it possible for authenticated attackers with Contributor-level access and above who are co-authors able to edit a post to set themselves as the post's owner (post_author), keeping access to the post even after they are removed as a co-author.
References
- https://wpsec.com/vuln/WPSEC-2026-2746/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.2.2/
- https://wordpress.org/plugins/co-authors-plus/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS