EUVD-2026-95819
GHSA-h96v-hrqg-p7pf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege user
-
ExploitSubmit crafted request with SQL payload
-
ExecutionInjection executed against database
-
ImpactExfiltrate sensitive data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated session with high privileges (PR:H) on a WordPress site running wp-post-author prior to version 4.1.0; the attacker reaches a plugin endpoint that passes unsanitized input into an SQL query. Limiting factors: the attacker must already possess a high-privilege account (no anonymous/low-role path indicated in available data), impact is limited to confidentiality (data disclosure, not modification or denial of service), and no user interaction is needed. The exact vulnerable parameter and endpoint are not specified in the provided data. |
| Impact | This is a moderate-severity, confirmed SQL injection (CWE-89) in the wp-post-author WordPress plugin, with a vendor/NVD CVSS 3.1 base score of 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N). The signals are internally consistent but point to a non-urgent issue: network-reachable (AV:N) and low attack complexity (AC:L), but it requires high privileges (PR:H), meaning an attacker must already hold an authenticated, high-privilege account before the flaw is reachable. Impact is confidentiality-only (C:H/I:N/A:N) - database read/exfiltration rather than site takeover. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no proof-of-concept or exploit code is indicated in the provided data, so exploitation is: no public exploit identified at time of analysis. The PR:H requirement is the dominant mitigating factor and is somewhat unusual for plugin SQLi (many such bugs are reachable by lower-privileged roles) - the input provides no privilege-context detail to verify whether PR:H is truly required, so this should be confirmed against the Tenable advisory (TRA-2026-61). Net assessment: a real but low-priority bug - the high-CVSS components (network vector) are offset by the privilege prerequisite and confidentiality-only impact. |
| Exploit ScenarioDerived | An attacker who already holds a high-privilege authenticated WordPress account (per PR:H) sends a crafted request to a vulnerable wp-post-author endpoint, injecting SQL that the plugin fails to neutralize. The injected query lets them read arbitrary database contents such as user records or secrets (C:H). No public proof-of-concept is identified in the provided data, and no user interaction is required (UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
SQL injection in the wp-post-author WordPress plugin before version 4.1.0 lets an authenticated attacker with high privileges inject arbitrary SQL through a plugin endpoint, allowing disclosure of data stored in the underlying WordPress database. The flaw is rated CVSS 3.1 4.9 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N), so exploitation requires an existing high-privilege account on the target site, no user interaction, and the impact is limited to confidentiality - integrity and availability are unaffected. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis, though the low complexity of the attack path means this should be treated as a realistic post-compromise or insider data-exfiltration vector on multi-author WordPress installations.
RemediationAI
Upgrade the wp-post-author plugin to version 4.1.0 or later - vendor-released patch: 4.1.0 - which is the only complete fix for CWE-89 in this component; verify the update actually applied, since WordPress plugin auto-updates can be blocked by version pinning or file-permission issues, and review the Tenable advisory at https://www.tenable.com/security/research/tra-2026-61 for confirmation. If immediate upgrade is not possible, compensating controls include temporarily deactivating the plugin (trade-off: the affected author-box/post-author features disappear from the site) or, if deactivation is unacceptable, restricting it via a maintenance/coming-soon mode so its endpoints are unreachable; additionally audit and reduce the number of high-privilege accounts (Administrator/Editor) because PR:H is the gating prerequisite, tighten role assignment so only trusted staff hold those roles, deploy a WAF with SQL-injection signatures on WordPress admin-ajax/REST paths (partial protection only, easily bypassed by encoding tricks, and does not fix the underlying defect), and review database and web server logs for unusual query patterns or unexpected data retrieval from high-privilege sessions to detect any exploitation that already occurred.
Affected ProductsAI
All versions of the wp-post-author WordPress plugin prior to 4.1.0 are affected; version 4.1.0 is the first fixed release. This is a third-party WordPress plugin rather than WordPress core, so any site with the plugin installed and active at a version below 4.1.0 - particularly multi-author blogs and sites that grant high-privilege accounts to contributors, editors, or external authors - is in scope. No CPE identifiers were provided in the input data; the vendor/coordinating reference for this finding is the Tenable research advisory at https://www.tenable.com/security/research/tra-2026-61.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command, in the wp-post-author WordPress plugin (the component reported by Tenable under TRA-2026-61). WordPress plugins are PHP code running against the site's MySQL/MariaDB backend; a CWE-89 defect here means user-supplied input reaches a SQL query without parameterization or proper escaping, so an attacker can append or alter SQL syntax and read result sets the application would not normally return. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N indicates the vulnerable code is reachable over the network with low attack complexity but only after the attacker has authenticated with high privileges (PR:H), and that the achieved impact is high confidentiality loss with no integrity or availability effect - consistent with a read-oriented injection (for example UNION- or subquery-based extraction of user, post, or plugin table data). The specific vulnerable parameter and endpoint are not identified in the available data, and no CPE strings were supplied, so the affected surface should be treated as the plugin's own request-handling code for whatever administrative or author-facing action it exposes.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Network-reachable injection with low complexity, but requires a high-privilege authenticated account (PR:H); impact is read-only data disclosure, so C:H and I:N/A:N.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author.
This issue affects wp-post-author before 4.1.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB