The Multicollab WordPress plugin suffers from a missing capability check in the 'cf_add_comment' function, which leads to unauthorized modification of data. Authenticated users with minimal privileges (Subscriber-level) can exploit this to add comments to any collaboration, bypassing intended access controls. This issue is tracked as CVE-2025-4202 and is classified under CWE-862 (Missing Authorization). The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low complexity, requiring low privileges and no user interaction, impacting integrity only. No patch or official fix has been documented as of the published date.

The vulnerability allows unauthorized users with Subscriber-level access or higher to add comments to arbitrary collaborations within the Multicollab plugin. This can lead to unauthorized modification of collaboration content, potentially disrupting editorial workflows or injecting misleading information. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor collaboration content for unauthorized comments. Avoid granting unnecessary permissions to users and consider disabling the plugin if the risk is unacceptable.