What is the CVSS score of CVE-2026-57643?

CVE-2026-57643 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L. EPSS exploitation probability: 0.2%.

Which versions of WP Post Author are affected by CVE-2026-57643?

The WP Post Author WordPress plugin (versions ≤3.9.1) contains a SQL injection vulnerability (CVSS 8.5) allowing authenticated users with basic contributor permissions to extract sensitive database…

How to fix or mitigate CVE-2026-57643?

Within 24 hours: Inventory all deployments of WP Post Author plugin, identify active versions, and audit contributor account controls. Within 7 days: Either disable the plugin if not operationally critical, or restrict contributor role creation to trusted administrators only; enable database query logging to detect anomalous activity. Within 30 days: Identify and deploy an alternative post-authoring solution; evaluate plugin source for security updates or plan permanent deactivation.

WP Post Author CVE-2026-57643

EUVD-2026-39758 HIGH

SQL Injection (CWE-89)

2026-06-26 audit@patchstack.com

GHSA-chrq-mj9q-326j

WordPress SQLi Wordpress Plugin

8.5

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.5 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

vuln.today AI

6.5 MEDIUM

Network-reachable, low-complexity SQLi needing a Contributor account (PR:L); confidentiality high from DB read, scope unchanged within the WordPress DB, integrity/availability impact not established.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 15:49 vuln.today

DescriptionCVE.org

Contributor SQL Injection in WP Post Author <= 3.9.1 versions.

AnalysisAI

SQL injection in the WP Post Author WordPress plugin (versions 3.9.1 and earlier) allows authenticated users with Contributor-level access to inject arbitrary SQL into the site database. Because exploitation requires only a low-privilege account (PR:L) over the network with no user interaction, any site that permits self-registration or has untrusted contributors is at material risk of database content disclosure. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but Patchstack-reported WordPress plugin SQLi flaws are commonly weaponized after disclosure.

Technical ContextAI

WP Post Author is a WordPress plugin that extends author profile, byline, and post-attribution functionality. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the plugin passes Contributor-supplied input into a database query without proper parameterization or sanitization, letting an attacker break out of the intended query context. In the WordPress context such injection typically targets the shared wp_* tables via wpdb, meaning a successful injection can read data well beyond the plugin's own scope, including the wp_users and wp_usermeta tables that hold password hashes and session/secret data. No CPE strings were provided in the intelligence, so the exact affected configuration is bounded only by the version statement '<= 3.9.1'.

RemediationAI

Upgrade WP Post Author to the latest release above 3.9.1 once confirmed via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-post-author/vulnerability/wordpress-wp-post-author-plugin-3-9-1-sql-injection-vulnerability?_s_id=cve); the input data does not specify an exact fixed version, so the patched build should be verified against the vendor/Patchstack listing before deployment. If an updated version is not yet available or cannot be applied immediately, reduce exposure by restricting who holds Contributor-or-higher accounts: disable open user registration (Settings > General > 'Anyone can register') and audit existing Contributor accounts, accepting the trade-off that legitimate guest authors lose self-service access. As a stronger temporary control, deactivate the WP Post Author plugin entirely - this removes the vulnerable code path at the cost of losing author-attribution features. A WordPress-aware WAF rule (e.g., Patchstack/Wordfence virtual patching) blocking SQLi patterns on the plugin's request parameters can serve as a compensating control but may produce false positives and should not be treated as a permanent fix.