EUVD-2026-95821
GHSA-77c9-9grr-g9r2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitSend crafted request to wp-post-author
-
ExecutionInject SQL into unsanitized parameter
-
ImpactExfiltrate database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the target WordPress site (CVSS PR:L), meaning the attacker must possess at least low-privilege credentials, and the site must run the vulnerable wp-post-author plugin version 4.0.0 up to but not including 4.1.0. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) against the plugin's affected functionality; the primary limiting factor is the requirement for valid low-privilege credentials, which blocks fully anonymous exploitation. Impact is confined to confidentiality (VC:H, VI:N/VA:N), indicating data disclosure via the injection rather than data modification or denial of service. |
| Impact | The input provides a CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scoring 7.1 (High), describing a network-exploitable, low-complexity SQL injection (CWE-89) requiring low-level privileges and no user interaction, with high confidentiality impact but no integrity or availability impact - consistent with a read-oriented injection used for database exfiltration rather than full compromise. No EPSS score, CISA KEV listing, or POC indicator is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only signal of real-world interest is that Tenable Research published an advisory (TRA-2026-62). The PR:L requirement is a meaningful limiter: an attacker needs at least an authenticated low-privilege account, which reduces the pool of attackers versus a fully unauthenticated flaw and makes mass untargeted exploitation less likely. On balance this is a genuine but moderate-priority issue - a credentialed data-disclosure bug in a WordPress plugin - rather than a drop-everything emergency; absent EPSS/KEV/POC data, exploitation likelihood cannot be quantified and should be treated as unknown rather than low. |
| Exploit ScenarioDerived | An attacker holding a low-privilege authenticated WordPress account (e.g., subscriber or contributor) sends a crafted request to a wp-post-author endpoint that fails to sanitize input before building an SQL query, injecting SQL to read arbitrary database contents such as user records and password hashes. No public exploit code is identified at time of analysis, and because the CVSS vector specifies PR:L the attack requires valid credentials but no victim interaction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
SQL injection in the WordPress plugin wp-post-author (versions 4.0.0 up to but not including 4.1.0) lets an authenticated, low-privilege user inject arbitrary SQL into plugin queries and read sensitive data from the site's underlying database. Exploitation is network-reachable, requires no user interaction, and is rated CVSS 7.1 (High) with high confidentiality impact but no integrity or availability impact, consistent with read-oriented database exfiltration rather than data tampering or denial of service. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); the primary barrier is the requirement for valid low-privilege credentials on the target WordPress site.
RemediationAI
Upgrade the wp-post-author plugin to 4.1.0 or later, the release at which the affected range (4.0.0 prior to 4.1.0) terminates and which therefore carries the vendor fix; this is the vendor-released patch per the affected-version data. Refer to the Tenable advisory at https://www.tenable.com/security/research/tra-2026-62 for confirmation of the fixed version and any caveats before or after upgrading, and apply the update through the standard WordPress plugin update mechanism or by deploying the vendor package directly. If immediate upgrade is not possible, compensating controls must target the prerequisite rather than the injection itself: reduce the number of accounts holding low-privilege roles able to reach the vulnerable plugin functionality, and audit existing Subscriber/Contributor accounts for unnecessary ones, accepting that this limits but does not eliminate exposure since any remaining low-privilege account can still exploit it. Deactivating the plugin removes the attack surface entirely but disables all author-profile and post-author display functionality on the site, which is a functional trade-off. Deploying WAF or reverse-proxy rules that block SQL metacharacter patterns and UNION/SELECT-style payloads on requests to wp-admin/admin-ajax.php and any REST routes registered by the plugin can raise the bar, but signature-based filtering is bypassable and may cause false positives on legitimate input. Because the assessed impact is confidentiality-only, also consider rotating database credentials and any secrets that may have been exposed if there is reason to believe the injection was exercised, and review database query logs for anomalous SELECT activity originating from low-privilege sessions.
Affected ProductsAI
The affected product is the WordPress plugin wp-post-author, specifically version 4.0.0 up to but not including 4.1.0; the reported issue states the vulnerability affects wp-post-author 4.0.0 prior to 4.1.0, so 4.1.0 and later releases are outside the affected range. No CPE strings were provided in the available intelligence, so the version range itself is the authoritative identifier. Any WordPress installation running this plugin within that version window is in scope, regardless of theme or hosting environment, because the vulnerable code resides in the plugin. The reporting source is Tenable, and the sole reference supplied is the Tenable research advisory at https://www.tenable.com/security/research/tra-2026-62, which should be consulted for the precise injection point and any additional affected artifact detail.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-89, improper neutralization of special elements used in an SQL command, in the WordPress plugin wp-post-author. In WordPress plugin code of this class, user-supplied parameters (typically from an AJAX action, REST route, or shortcode/query parameter) are concatenated into a SQL statement instead of being passed through parameterized queries such as $wpdb->prepare() with placeholders, allowing an attacker to break out of the intended query context and append their own SQL. Because the vulnerable component is a plugin installed on a WordPress site and the assessed vector is AV:N with PR:L and UI:N, the injection point is reachable over HTTP by any holder of a low-privilege account (for example a Subscriber or Contributor-level user) without any victim interaction. The assessed impact profile (VC:H with VI:N and VA:N) indicates the injected SQL is used to read data - post content, user records, password hashes, tokens, or other database-resident secrets - rather than to modify or destroy it, though the severity of disclosure depends entirely on the privileges of the database account backing WordPress. No CPE strings were supplied with the intelligence, so exact affected product identification rests on the plugin's version range (4.0.0 prior to 4.1.0) rather than a machine-readable CPE entry.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable SQLi needing a low-privilege account gives AV:N/AC:L/PR:L/UI:N; confidentiality-only data exfiltration sets C:H with I:N/A:N and unchanged scope.
Primary rating from Vendor (tenable).
CVSS VectorVendor: tenable
DescriptionCVE.org
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author.
This issue affects wp-post-author version 4.0.0 prior to 4.1.0.
Executive ViewAI
The wp-post-author WordPress plugin, in versions 4.0.0 up to but not including 4.1.0, exposes site databases to unauthorized read access via SQL injection. This creates a confidentiality risk for organizations running affected WordPress sites, because an attacker with a low-privilege account could extract sensitive data. Leadership should care because no public exploit has been identified at time of analysis, but the absence of a vendor patch means affected sites remain exposed until mitigations are applied.
No vendor-released patch identified at time of analysis. Disable or remove wp-post-author if not essential; otherwise restrict access to trusted users, enforce least privilege, deploy WAF/SQLi virtual patching, monitor database and plugin logs for anomalous queries, and upgrade to a fixed release when available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB