{
 "id": "WPSEC-2026-2746",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2746/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2746/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2746/index.md",
 "title": "Co-Authors Plus <= 4.2.1 - Authenticated (Contributor+) Missing Authorization to Post Author Change",
 "description": "The Co-Authors Plus plugin for WordPress is vulnerable to unauthorized modification of data via the post 'author' field of REST API and classic editor saves in all versions up to, and including, 4.2.1, due to the plugin skipping the re-derivation of post_author from the post's author terms on every REST save and on classic saves that carry co-author form fields, even when those fields fail the nonce or capability check. This makes it possible for authenticated attackers with Contributor-level access and above who are co-authors able to edit a post to set themselves as the post's owner (post_author), keeping access to the post even after they are removed as a co-author.",
 "plugin": {
  "slug": "co-authors-plus",
  "name": "Co-Authors Plus",
  "full_name": "Co-Authors Plus",
  "wordpress_org": "https://wordpress.org/plugins/co-authors-plus/",
  "advisories_url": "https://wpsec.com/vuln/plugin/co-authors-plus/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/co-authors-plus"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.2.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.2.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.2.2",
 "remediation": "Update to 4.2.2 or later.",
 "fix_released": "2026-11-07T16:23:19+00:00",
 "published": "2026-11-08T16:41:10+00:00",
 "updated": "2026-11-08T13:07:58.484128+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2746/",
  "https://plugins.svn.wordpress.org/co-authors-plus/tags/4.2.2/",
  "https://wordpress.org/plugins/co-authors-plus/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/co-authors-plus",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-08"
 }
}