What is the CVSS score of CVE-2026-4338?

CVE-2026-4338 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Activitypub are affected by CVE-2026-4338?

The ActivityPub WordPress plugin before version 8.0.2 contains an access control flaw that exposes draft, scheduled, and pending posts to unauthenticated users, creating a direct confidentiality risk…. A patch is available.

Is there a public PoC exploit available for CVE-2026-4338?

Yes, a public proof-of-concept exploit is available for CVE-2026-4338. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4338?

Within 24 hours: Audit all WordPress instances for ActivityPub plugin installations and current versions. Within 7 days: Update ActivityPub plugin to version 8.0.2 or later on all affected systems. Within 30 days: Conduct content review to determine if draft/scheduled/pending posts were exposed; implement access logging on post visibility changes to detect past unauthorized access.

Activitypub CVE-2026-4338

EUVD-2026-20058 HIGH

2026-04-08 WPScan

GHSA-v6vj-m59r-f4gf

WordPress Information Disclosure Activitypub Unknown

7.5

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (WPScan) · only source for this CVE.

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0.2

PoC Detected

Apr 08, 2026 - 21:26 vuln.today

Public exploit code

EUVD ID Assigned

Apr 08, 2026 - 06:30 euvd

EUVD-2026-20058

Analysis Generated

Apr 08, 2026 - 06:30 vuln.today

CVE Published

Apr 08, 2026 - 06:00 nvd

HIGH 7.5

DescriptionCVE.org

The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts

AnalysisAI

Improper access control in the ActivityPub WordPress plugin before 8.0.2 exposes draft, scheduled, and pending posts to unauthenticated remote users, resulting in confidentiality breach. This information disclosure vulnerability (CVSS 7.5) allows network-based attackers to access unpublished content without authentication or user interaction. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). EPSS score of 0.02% (6th percentile) suggests low current exploitation probability despite POC availability, but SSVC framework marks it as automatable with partial technical impact.

Technical ContextAI

The ActivityPub plugin implements the ActivityPub protocol for WordPress, enabling federated social networking capabilities. This vulnerability stems from insufficient access control validation when filtering posts for external display. The plugin fails to properly enforce WordPress's built-in post status checks (draft, scheduled, pending) before exposing content through the ActivityPub API endpoints. The affected product is identified as 'cpe:2.3:a:unknown:activitypub' covering all versions prior to 8.0.2. While no specific CWE classification was assigned, this represents a classic broken access control issue where authorization checks are missing or improperly implemented at the API boundary, allowing unauthorized information retrieval from restricted content repositories.

RemediationAI

Upgrade the ActivityPub WordPress plugin to version 8.0.2 or later immediately to remediate this vulnerability. The vendor-released patch version 8.0.2 addresses the improper access control issue by implementing proper post status filtering before content exposure through ActivityPub endpoints. Administrators should access the WordPress plugin management interface and update ActivityPub through the standard update mechanism. For detailed vulnerability information and confirmation of the fix, consult the WPScan vulnerability database entry at https://wpscan.com/vulnerability/50f68395-72fc-4f99-8e6d-6aa90cc640b5/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-4338. If immediate patching is not feasible, temporary workarounds include disabling the ActivityPub plugin until upgrade is possible, or restricting network access to the WordPress installation using web application firewall rules that block unauthorized access to ActivityPub API endpoints. Review server logs for suspicious access patterns to draft/scheduled content URLs to determine if exploitation occurred prior to patching.