The ActivityPub WordPress plugin by Automattic incorrectly routes content, allowing unauthenticated visitors to view posts marked as draft, scheduled or pending. This flaw results in the disclosure of unpublished content without credentials, violating confidentiality of private WordPress posts. The plugin’s lack of proper authentication checks during route handling is the root cause.

This vulnerability impacts the ActivityPub plugin for WordPress distributed by Automattic, installed on any WordPress site using a version earlier than 8.0.2. The affected environment includes WordPress installations that rely on the plugin for activity feed and routing operations.

The CVSS score of 7.5 indicates a high severity for this information disclosure flaw. The EPSS score is below 1%, suggesting a low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated web request to the plugin’s routing endpoints, meaning any Internet‑connected user who can reach the WordPress instance can trigger the disclosure. No additional authentication or privilege escalation is necessary. The likely attack vector is unauthenticated HTTP requests directed to the plugin’s routes, which can be accessed through a browser or automated script over the network.