Activitypub CVE-2026-4338

ActivityPub WordPress plugin versions before 8.0.2. Remote unauthenticated attacker can access draft, scheduled, and pending posts without authentication. No special conditions — default plugin installation affected.

Real-world risk assessment reveals moderate concern despite the high CVSS score of 7.5. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates a remotely exploitable vulnerability with low attack complexity requiring no privileges or user interaction, resulting in high confidentiality impact. However, EPSS probability of 0.02% (6th percentile) suggests minimal observed exploitation activity in the wild. The SSVC framework confirms publicly available POC and marks the vulnerability as automatable with partial technical impact, elevating priority for organizations using this plugin. The vulnerability is not present in CISA KEV, indicating no confirmed active exploitation campaigns. Primary risk is reputational damage and competitive intelligence exposure from leaked unpublished content rather than system compromise. Organizations running WordPress sites with ActivityPub enabled face immediate risk, while those without the plugin or using it only for already-public content face negligible risk. The combination of POC availability and automation potential warrants prompt patching despite low exploitation probability.

An unauthenticated remote attacker discovers a WordPress site running the vulnerable ActivityPub plugin version 8.0.1. Using publicly available exploit code, the attacker queries the ActivityPub API endpoints without authentication credentials. The plugin improperly exposes posts with non-public status values, allowing the attacker to enumerate and retrieve all draft blog posts containing sensitive product announcements scheduled for next quarter, pending articles with confidential business strategy, and draft posts containing unpublished research findings. The attacker exfiltrates this competitive intelligence or leaks embargoed information publicly, causing reputational damage and competitive disadvantage. The low attack complexity and network-based vector enable automated scanning tools to identify and exploit vulnerable installations at scale.