CVE-2026-4338

CVE-2026-4338 is an authentication bypass vulnerability affecting the ActivityPub WordPress plugin versions prior to 8.0.2, where improper post filtering allows unauthenticated users to access draft, scheduled, and pending posts that should remain restricted. The vulnerability has a CVSS score of 7.5 (HIGH) with a network-based attack vector requiring no authentication or user interaction, resulting in high confidentiality impact through unauthorized information disclosure. Current exploitation appears limited, as the vulnerability is not listed on the Known Exploited Vulnerabilities catalog and shows minimal community attention with an inactive status on threat tracking lists. The EPSS score of 0.00057 indicates relatively low probability of exploitation in the wild compared to other CVEs, suggesting the threat landscape has not yet focused attention on this particular flaw. Users of the ActivityPub plugin should prioritize updating to version 8.0.2 or later to remediate this information disclosure risk.