Co-Authors Plus

Co-Authors Plus has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it is fixed as of September 2026. Their average CVSS score is 7.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Exposure Of Sensitive Information To An Unauthorized Actor, behind 1 of the records (100%).

The one issue recorded for Co-Authors Plus has a vendor fix available, so running the current release closes it.

All of these findings were reported by Douglas Johnson. Co-Authors Plus is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSHigh
7.5/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Co-Authors Plus vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5

Co-Authors Plus 3.5 - 3.5.1 - Sensitive Information Disclosure

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Co-Authors Plus banner
Latestv4.1.1

Co-Authors Plus

Automattic

Author

Automattic

3.5(77)
70/100
Last Updated
2026-06-26 (3mo ago)
Active Installs
20,000+
Downloads
1,575,312
Requires WP
6.4+
Requires PHP
7.4+
Tested up to
WP 7.0.4
Created
2009-04-24 (18y ago)

Assign multiple bylines to posts, pages, and custom post types via a search-as-you-type input box. Co-authored posts appear on a co-author’s archive page and in their feed. Co-authors may edit the posts they are associated with, and co-authors who are contributors may only edit posts if they have not been published (as is core behavior). Add writers as bylines without creating WordPress user accounts. Simply create a guest author profile for the writer and assign the byline as you normally would. On the frontend, use the Co-Authors Plus template tags or the block editor blocks to list co-authors anywhere you’d normally list the author. Documentation Usage — themer and site-owner guides live on the GitHub Wiki: template tags, blocks, guest author management, and multisite. Developer reference — lives in-repo under docs/ (not bundled in the distribution ZIP): Filters and actions REST API Upgrading to 4.0 Co-Authors Plus is an almost complete rewrite of the Co-Authors plugin originally developed by Weston Ruter (2007). The original plugin was inspired by the ‘Multiple Authors‘ plugin by Mark Jaquith (2005).

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C