WP Post Author CVE-2026-42708

Exploitation requires an authenticated high-privilege account (CVSS PR:H - administrator-level) on a WordPress installation with the WP Post Author plugin (version 4.0.0 or earlier) installed and active. The specific vulnerable parameter, endpoint, or admin feature is not named in the available description, only that it permits blind SQL injection. Key limiting factors: the admin-level privilege requirement means an untrusted external actor cannot exploit this directly against a default install; realistic risk arises mainly in multi-author/multi-site setups where elevated roles are delegated, or where an admin account is already compromised via another vector. No user interaction by a victim is required (UI:N).

Multiple signals point to a moderate, not critical, real-world priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) scores 7.6 (High), but the single most important mitigating factor is PR:H - exploitation requires an attacker to already hold high-privilege (administrator-level) access to the WordPress site, which sharply limits the threat population to insiders, compromised admin accounts, or multi-site environments where lower-trust users hold elevated roles. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so this is 'no public exploit identified at time of analysis' - exploitation is theoretical rather than observed. CWE-89 blind SQL injection is consistent with the C:H (database read via inference) and A:L (query-load/timing impact) impacts, though the input's I:N claims no integrity impact, which is somewhat conservative for SQLi. Note a conflict worth flagging: the input vector asserts S:C (scope change), but a blind SQLi confined to the WordPress database would normally be S:U (unchanged); my independent assessment treats scope as unchanged. Bottom line: a legitimately-rated High-severity flaw whose practical risk is tempered by the admin-privilege precondition, making it a patch-in-normal-cycle item rather than an emergency, absent any exploitation evidence.

An attacker who already holds a high-privilege (administrator) account on a WordPress site running WP Post Author ≤4.0.0 submits crafted input to a vulnerable plugin parameter, injecting SQL that the plugin passes unsanitized into a database query. Because the injection is blind, the attacker infers data (user credentials, hashes, secrets) through boolean or time-based response differences rather than direct output. No public exploit code is identified in the provided data, so an attacker would need to develop the payload against the plugin's query logic.