EUVD-2025-209886
GHSA-f4x8-m8jx-pfpg
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'cf_add_comment' function in all versions up to, and including, 5.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add comments to arbitrary collaborations.
AnalysisAI
Authorization bypass in Multicollab WordPress plugin allows authenticated attackers with Subscriber-level privileges to inject comments into arbitrary editorial collaborations. This affects all versions up to and including 5.2. While CVSS rates this 4.3 (Low), the ability for low-privileged users to pollute editorial workflows could enable social engineering, misinformation injection into content review processes, or disruption of collaborative editing. EPSS data not provided. No active exploitation confirmed (not in CISA KEV). Patch available in version 3519252 per WordPress plugin repository changeset.
Technical ContextAI
This vulnerability stems from CWE-862 (Missing Authorization Check) in the 'cf_add_comment' function within the Multicollab plugin's class-commenting-block-admin.php file. Multicollab is a WordPress plugin enabling editorial teams to collaborate on content through inline comments and workflow management. The affected function fails to validate whether the authenticated user has appropriate capabilities before allowing comment creation on collaboration objects. WordPress uses a tiered capability system (Subscriber < Contributor < Author < Editor < Administrator), and proper authorization checks should restrict comment creation to users with legitimate editorial roles. The missing check allows any authenticated user, including Subscribers who normally have minimal permissions (can only read content and manage their own profile), to invoke the comment addition functionality on any collaboration thread regardless of their actual involvement in that editorial process.
RemediationAI
Update Multicollab plugin to the patched version corresponding to WordPress plugin changeset 3519252 or later, available at https://plugins.trac.wordpress.org/changeset/3519252/. WordPress administrators should navigate to Plugins > Installed Plugins, locate Multicollab, and click Update if available. If automatic updates are not yet distributed, download the latest version from the official WordPress plugin repository. As a temporary workaround until patching, restrict user registration to prevent untrusted Subscriber account creation (Settings > General > Membership: uncheck 'Anyone can register'), or use a role management plugin to audit and remove unnecessary Subscriber accounts. Note that disabling user registration may impact legitimate site functionality if public registration is required. For sites requiring open registration, consider implementing additional access controls at the web application firewall level to restrict admin-ajax.php requests from Subscriber-role users, though this may cause compatibility issues with other plugins and requires careful testing.
More from same product – last 7 days
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers t
Authentication bypass in the Login with OTP plugin for WordPress (all versions up to and including 1.6) lets unauthentic
Unauthenticated privilege escalation in the Advanced Custom Fields: Extended (ACFE) WordPress plugin through version 0.9
Blind SQL injection in the RealMag777 'Active Products Tables for WooCommerce' WordPress plugin (versions up to and incl
Blind SQL injection in the RealMag777 "Active Products Tables for WooCommerce" WordPress plugin (all versions up to and
Share
External POC / Exploit Code
Leaving vuln.today