What is the CVSS score of CVE-2026-4338?

CVE-2026-4338 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-4338?

The ActivityPub WordPress plugin before version 8.0.2 contains an access control flaw that exposes draft, scheduled, and pending posts to unauthenticated users, creating a direct confidentiality risk…. A patch is available.

Is there a public PoC exploit available for CVE-2026-4338?

Yes, a public proof-of-concept exploit is available for CVE-2026-4338. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-4338?

Within 24 hours: Audit all WordPress instances for ActivityPub plugin installations and current versions. Within 7 days: Update ActivityPub plugin to version 8.0.2 or later on all affected systems. Within 30 days: Conduct content review to determine if draft/scheduled/pending posts were exposed; implement access logging on post visibility changes to detect past unauthorized access.

WordPress CVE-2026-4338

EUVD-2026-20058 HIGH

2026-04-08 WPScan

GHSA-v6vj-m59r-f4gf

WordPress Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:02 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

8.0.2

PoC Detected

Apr 08, 2026 - 21:26 vuln.today

Public exploit code

EUVD ID Assigned

Apr 08, 2026 - 06:30 euvd

EUVD-2026-20058

Analysis Generated

Apr 08, 2026 - 06:30 vuln.today

CVE Published

Apr 08, 2026 - 06:00 nvd

HIGH 7.5

DescriptionCVE.org

The ActivityPub WordPress plugin before 8.0.2 does not properly filter posts to be displayed, allowed unauthenticated users to access drafts/scheduled/pending posts

AnalysisAI

Improper access control in the ActivityPub WordPress plugin before 8.0.2 exposes draft, scheduled, and pending posts to unauthenticated remote users, resulting in confidentiality breach. This information disclosure vulnerability (CVSS 7.5) allows network-based attackers to access unpublished content without authentication or user interaction. Publicly available exploit code exists, though no confirmed active exploitation (not in CISA KEV). EPSS score of 0.02% (6th percentile) suggests low current exploitation probability despite POC availability, but SSVC framework marks it as automatable with partial technical impact.

Technical ContextAI

The ActivityPub plugin implements the ActivityPub protocol for WordPress, enabling federated social networking capabilities. This vulnerability stems from insufficient access control validation when filtering posts for external display. The plugin fails to properly enforce WordPress's built-in post status checks (draft, scheduled, pending) before exposing content through the ActivityPub API endpoints. The affected product is identified as 'cpe:2.3:a:unknown:activitypub' covering all versions prior to 8.0.2. While no specific CWE classification was assigned, this represents a classic broken access control issue where authorization checks are missing or improperly implemented at the API boundary, allowing unauthorized information retrieval from restricted content repositories.

RemediationAI

Upgrade the ActivityPub WordPress plugin to version 8.0.2 or later immediately to remediate this vulnerability. The vendor-released patch version 8.0.2 addresses the improper access control issue by implementing proper post status filtering before content exposure through ActivityPub endpoints. Administrators should access the WordPress plugin management interface and update ActivityPub through the standard update mechanism. For detailed vulnerability information and confirmation of the fix, consult the WPScan vulnerability database entry at https://wpscan.com/vulnerability/50f68395-72fc-4f99-8e6d-6aa90cc640b5/ and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-4338. If immediate patching is not feasible, temporary workarounds include disabling the ActivityPub plugin until upgrade is possible, or restricting network access to the WordPress installation using web application firewall rules that block unauthorized access to ActivityPub API endpoints. Review server logs for suspicious access patterns to draft/scheduled content URLs to determine if exploitation occurred prior to patching.

More in WordPress

View all

CVE-2016-10045 CRITICAL Act Now POC

9.8 Dec 30

The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman

CVE-2023-6553 CRITICAL Act Now POC

9.8 Dec 15

The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1

CVE-2024-5084 CRITICAL Act Now POC

9.8 May 23

The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil

CVE-2024-8353 CRITICAL Act Now POC

9.8 Sep 28

The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all

CVE-2020-36847 CRITICAL Act Now POC

9.8 Jul 12

The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner

CVE-2025-11749 CRITICAL Emergency POC

9.8 Nov 05

The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint

CVE-2016-1209 CRITICAL Emergency POC

9.8 May 14

The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via

CVE-2024-4443 CRITICAL Act Now POC

9.8 May 22

The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based

CVE-2024-1698 CRITICAL Act Now POC

9.8 Feb 27

SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a

CVE-2023-6875 CRITICAL Emergency POC

9.8 Jan 11

The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i

CVE-2024-1512 CRITICAL Emergency POC

9.8 Feb 17

The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base

CVE-2024-3495 CRITICAL Emergency POC

9.8 May 22

The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

CVE-2023-7028 CRITICAL POC

10.0

CVE-2017-0213 HIGH POC

7.3

CVE-2026-4338 vulnerability details – vuln.today

Back

WordPress CVE-2026-4338

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in WordPress

Same technique Information Disclosure

Share

External POC / Exploit Code