Authorization bypass in PublishPress Co-Authors, Multiple Authors and Guest Authors in an…
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.
Summary
The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Insecure Direct Object Reference to Privilege Escalation/Account Takeover in all versions up to, and including, 4.7.1 via the action_edited_author() due to missing validation on the 'authors-user_id' user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to update arbitrary user accounts email addresses, including administrators, which can then be leveraged to reset that user's account password and gain access.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PublishPress | Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors | up to 4.7.1 | — | No fix listed | CNA |
- Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors VendorPublishPress Affected up to 4.7.1 Fixed in — No fix listed CNA
CPE names CISA-ADP · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:publishpress:authors:*:*:*:*:*:*:*:* | — | — | PublishPress |
- cpe:2.3:a:publishpress:authors:*:*:*:*:*:*:*:* Versions — — ·PublishPress
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9215
- 2026-10-03 Alias added: GHSA-9h89-9cwp-q9p5
References
Other 3
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d0506137-82e3-4988-9b23-370465a866c0?source=cve
- https://plugins.trac.wordpress.org/browser/publishpress-authors/tags/4.7.1/src/core/Classes/Author_Editor.php#L594
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3169244%40publishpress-authors&new=3169244%40publishpress-authors&sfp_email=&sfph_mail=#file7
More PublishPress vulnerabilities
- TI-2022-03111 PublishPress Capabilities < 2.5.2 - Admin+ PHP Objection Injection CVSS 3.1HIGH 7.2
- TI-2021-07310 PublishPress Capabilities < 2.3.1 - Unauthenticated Arbitrary Options Update to Blog Compromise CVSS 3.1CRITICAL 9.8
- TI-2026-25067 WordPress PublishPress Revisions plugin <= 3.7.23 - SQL Injection vulnerability CVSS 3.1CRITICAL 9.3
- TI-2026-20427 WordPress PublishPress Authors plugin <= 4.10.1 - Broken Access Control vulnerability CVSS 3.1HIGH 7.5
- TI-2025-30658 WordPress Gutenberg Blocks <= 3.3.1 - Local File Inclusion Vulnerability CVSS 3.1HIGH 7.5
- TI-2025-29993 WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2024-9215 · CVE Program
- CVE-2024-9215 · NVD
- FIRST EPSS
- GHSA-9h89-9cwp-q9p5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences