CVE-2026-4338: ActivityPub WordPress Info Disclosure Flaw

CVE-2026-4338 Overview

CVE-2026-4338 is an information disclosure vulnerability in the ActivityPub WordPress plugin before version 8.0.2. The plugin fails to properly filter posts before displaying them, allowing unauthenticated users to access draft, scheduled, and pending posts that should remain private until publication.

Critical Impact

Unauthenticated attackers can access unpublished content including drafts, scheduled posts, and pending review posts, potentially exposing sensitive information before intended publication.

Affected Products

• ActivityPub WordPress plugin versions prior to 8.0.2
• WordPress sites with ActivityPub plugin enabled
• Fediverse-connected WordPress installations using vulnerable plugin versions

Discovery Timeline

• 2026-04-08 - CVE CVE-2026-4338 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-4338

Vulnerability Analysis

This vulnerability stems from improper access control in the ActivityPub WordPress plugin's post filtering mechanism. The ActivityPub plugin enables WordPress sites to integrate with the Fediverse, allowing content to be shared across decentralized social networks like Mastodon.

The vulnerability allows unauthenticated users to bypass normal WordPress post visibility controls and access content that has not yet been published. This includes posts in draft status (still being written), scheduled posts (set to publish at a future date), and pending posts (awaiting editorial review).

The exposure of unpublished content can have significant consequences for organizations, including premature disclosure of announcements, exposure of unfinished or unreviewed content, and potential competitive or reputational damage.

Root Cause

The root cause is an improper post filtering implementation within the ActivityPub plugin. When handling requests for post content, the plugin fails to adequately verify that posts have been officially published before making them accessible through the ActivityPub protocol endpoints. This missing authorization check allows the plugin to serve content that WordPress's core access control would normally restrict.

Attack Vector

The attack can be executed remotely over the network without any authentication or user interaction. An attacker can directly query ActivityPub endpoints on a vulnerable WordPress site to enumerate and retrieve unpublished posts. Since the ActivityPub protocol is designed for federation and content sharing, these endpoints are inherently exposed to external requests, making exploitation straightforward for any attacker aware of the vulnerability.

The exploitation requires no special privileges or complex attack chains—simply sending properly formatted requests to the ActivityPub-enabled WordPress site can reveal protected content.

Detection Methods for CVE-2026-4338

Indicators of Compromise

• Unusual access patterns to ActivityPub API endpoints from unknown IP addresses
• Requests attempting to enumerate post content through ActivityPub endpoints
• Access logs showing requests for content identifiers that correspond to unpublished posts
• Increased API traffic to /wp-json/activitypub/ endpoints without corresponding legitimate federation activity

Detection Strategies

• Monitor web server access logs for abnormal request patterns to ActivityPub endpoints
• Implement rate limiting and anomaly detection on WordPress REST API endpoints
• Review audit logs for unauthorized access to draft or scheduled post content
• Configure web application firewall (WAF) rules to detect enumeration attempts against ActivityPub endpoints

Monitoring Recommendations

• Enable detailed logging for ActivityPub plugin activity
• Set up alerts for high-volume requests to ActivityPub endpoints from single IP addresses
• Monitor for access attempts to unpublished content identifiers
• Regularly audit which posts have been accessed through ActivityPub federation

How to Mitigate CVE-2026-4338

Immediate Actions Required

• Update the ActivityPub WordPress plugin to version 8.0.2 or later immediately
• Audit any unpublished content that may have been exposed on affected installations
• Review access logs to determine if the vulnerability was exploited prior to patching
• Consider temporarily disabling the ActivityPub plugin until the update can be applied if immediate patching is not possible

Patch Information

The vulnerability has been addressed in ActivityPub plugin version 8.0.2. Site administrators should update through the WordPress plugin management interface or manually download the patched version. For detailed vulnerability information, refer to the WPScan Vulnerability Report.

Workarounds

• Temporarily disable the ActivityPub plugin if an immediate update is not feasible
• Implement IP-based access restrictions on ActivityPub endpoints if federation is limited to known servers
• Configure a web application firewall to block suspicious requests to ActivityPub endpoints
• Limit the plugin's functionality through WordPress settings until the patched version is deployed

# Check current ActivityPub plugin version via WP-CLI
wp plugin list --name=activitypub --fields=name,version,status

# Update the ActivityPub plugin to the latest version
wp plugin update activitypub

# Verify the update was successful
wp plugin list --name=activitypub --fields=name,version,status

# If immediate update is not possible, temporarily deactivate the plugin
wp plugin deactivate activitypub