Unauthorized Data Modification in Multicollab Plugin for WordPress

CVE-2025-4202

What is CVE-2025-4202?

The Multicollab: Content Team Collaboration and Editorial Workflow plugin for WordPress contains a security flaw that allows authenticated attackers, with Subscriber-level access or higher, to modify data by exploiting a lack of necessary capability checks in the 'cf_add_comment' function. This vulnerability affects all versions of the plugin up to and including version 5.2, permitting unauthorized users to add comments to arbitrary collaborations, potentially leading to misinformation or unauthorized content alterations.

References