# Co-Authors Plus <= 4.2.1 - Authenticated (Contributor+) Missing Authorization to Post Author Change

- **ID:** WPSEC-2026-2746
- **Plugin:** Co-Authors Plus (`co-authors-plus`), https://wordpress.org/plugins/co-authors-plus/
- **Affected versions:** all versions before 4.2.2
- **Fixed in:** 4.2.2 (Update to 4.2.2 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-08)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/co-authors-plus
- **Fix released:** 2026-11-07
- **Published:** 2026-11-08
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2746/

## Description

The Co-Authors Plus plugin for WordPress is vulnerable to unauthorized modification of data via the post 'author' field of REST API and classic editor saves in all versions up to, and including, 4.2.1, due to the plugin skipping the re-derivation of post_author from the post's author terms on every REST save and on classic saves that carry co-author form fields, even when those fields fail the nonce or capability check. This makes it possible for authenticated attackers with Contributor-level access and above who are co-authors able to edit a post to set themselves as the post's owner (post_author), keeping access to the post even after they are removed as a co-author.

## References

- https://wpsec.com/vuln/WPSEC-2026-2746/
- https://plugins.svn.wordpress.org/co-authors-plus/tags/4.2.2/
- https://wordpress.org/plugins/co-authors-plus/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2746/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.