IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
7.5High

CVE-2026-4338ActivityPub Routing < 8.0.2 - Unauthenticated Drafts/Scheduled/Pending Posts Disclosure

ActivityPub Published: (7 months ago)

Description

The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts

Weakness (CWE): CWE-200

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
automattic activitypub < 8.0.2
— ActivityPub < 8.0.2

References and patches

CPE matches (NVD) (1)
  • cpe:2.3:a:automattic:activitypub:*:*:*:*:*:wordpress:*:* < 8.0.2

Recent CVEs in the same product — WordPress plugins & themes