CVE-2023-3707 in ActivityPub Plugin
Summary
by MITRE • 10/25/2023
The ActivityPub WordPress plugin before 1.0.0 does not ensure that post contents to be displayed are public and belong to the plugin, allowing any authenticated user, such as subscriber to retrieve the content of arbitrary post (such as draft and private) via an IDOR vector. Password protected posts are not affected by this issue.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The ActivityPub WordPress plugin prior to version 1.0.0 contains a critical Insecure Direct Object Reference vulnerability that compromises the confidentiality of user-generated content within WordPress installations. This flaw stems from insufficient access control checks when processing requests for post data intended for federation via the ActivityPub protocol. The plugin fails to verify whether the requested post is publicly accessible or belongs to an authorized context before retrieving and returning its contents. Consequently, any authenticated user with even the lowest privilege level, such as a subscriber, can exploit this logic error to access sensitive information that should remain restricted.
The technical nature of this vulnerability allows for arbitrary data retrieval through manipulated identifiers. By altering the post ID parameter in API requests or direct plugin endpoints, an attacker can bypass standard WordPress visibility restrictions. This includes accessing posts marked as drafts, which are typically hidden from public view and intended only for editorial review, as well as private posts that are restricted to specific users or administrators. The vulnerability specifically targets content where privacy settings have been explicitly configured by the site owner, indicating a failure in the plugin's internal logic to respect these permissions during data serialization and transmission processes.
The operational impact of this flaw is significant regarding data integrity and user trust. Drafts often contain unpublished ideas, sensitive business strategies, or personal information that authors do not intend for public consumption. Private posts may include confidential communications or restricted community discussions. The exposure of such content can lead to intellectual property theft, privacy violations, and reputational damage for both individual users and organizations relying on WordPress for their digital presence. Although password-protected posts are noted as unaffected due to additional authentication layers, the ability to leak drafts and private entries represents a severe breach of expected security boundaries within the application environment.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in enforcing restrictions on access to data objects by authorized actors. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as it requires an authenticated session to execute the exploitation vector. The scenario exemplifies how insufficient validation of object ownership and visibility status can lead to unauthorized information disclosure even when standard authentication mechanisms are in place.
To mitigate this risk, site administrators must immediately update the ActivityPub WordPress plugin to version 1.0.0 or later, where these access control checks have been corrected. Until an upgrade is possible, it is advisable to disable the plugin if its functionality is not strictly required for public-facing federation activities. Additionally, implementing strict input validation and ensuring that all data retrieval functions explicitly check post visibility status against current user permissions can prevent similar issues in other plugins or custom code. Regular security audits of third-party WordPress extensions are essential to maintain a robust defense posture against logic-based vulnerabilities that bypass traditional authentication layers.