EUVD-2026-53288
GHSA-xjmx-223q-52rw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L reflects required author-level authentication; UI:R corrects the assigned vector because admin must load post list for injection to fire.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WP Post Author - Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_metabox_authors_list' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step chain: an attacker first saves a crafted guest-author token via the wpma_metabox_authors_list parameter during post creation or editing, then triggers the injection when any admin user loads the post list screen at /wp-admin/edit.php, causing the injected SQL result to be rendered in the Authors column.
AnalysisAI
SQL injection in the WP Post Author WordPress plugin (all versions through 3.9.1) enables authenticated attackers with author-level access to extract arbitrary data from the WordPress database. Exploitation follows a deliberate two-step chain: the attacker stores a malicious payload in the wpma_metabox_authors_list parameter during post creation or editing, and the injection fires when any administrator loads the post list screen at /wp-admin/edit.php, rendering injected SQL results in the Authors column. No public exploit or CISA KEV listing has been identified at time of analysis; however, Wordfence has published a threat-intelligence record and the vulnerable source lines are publicly browsable in the plugin SVN repository.
Technical ContextAI
The affected plugin, identified by CPE cpe:2.3:a:afthemes:wp_post_author_-_author_box,_multiple_authors,_guest_authors_&_custom_avatars:*:*:*:*:*:*:*:*, is a PHP WordPress plugin providing multi-author management, guest author support, and custom avatars. The root cause (CWE-89, Improper Neutralization of Special Elements used in an SQL Command) is insufficient escaping of the user-supplied wpma_metabox_authors_list parameter combined with lack of parameterized query preparation in the multi-authors module. The publicly browsable source references (wpa-multi-authors.php at lines L110, L231, and L312) indicate multiple points in the codebase where unsanitized input is incorporated into existing SQL queries, consistent with a generic append-injection class rather than a blind or out-of-band variant. The injection surfaces in a deferred execution context: the payload is persisted at write time (post save) and executed at read time (admin post list load), decoupling attacker action from injection trigger.
RemediationAI
An upstream fix has been committed to the WordPress plugin SVN repository (changeset 3577603 in wpa-multi-authors.php, visible at the Trac changeset reference), but a specific released version number containing the fix is not confirmed in the available input data - site administrators should update to the latest available version from the WordPress plugin directory and verify the installed version is newer than 3.9.1. The Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/ca5cb925-6f95-4f81-92d0-5f3c8e5f7d59 should be checked for a confirmed fix version. As a compensating control pending update, WordPress administrators can restrict author-level user accounts from creating or editing posts containing the wpma_metabox_authors_list meta field, or temporarily disable the multi-authors functionality within the plugin settings, which removes the injection surface at the cost of the multiple-authors feature. Restricting access to /wp-admin/edit.php is not viable as it is a core admin function, but monitoring WordPress audit logs for unusual access to that screen by non-admin roles can serve as a detective control.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today