CVE-2026-108685: WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Post Authorto a version that resolves this vulnerability.Fixed in 4.2.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using WP Post Author versions before 4.2.0 that expose a front-end registration form declaring the display name, nickname, or website field are affected. The first user account is the target, and it is normally the administrator account.
What does an attacker need to exploit it?
An attacker does not need authentication. They need access to the affected front-end registration flow and a registration form that declares at least one of the affected profile fields.
What profile data can be changed?
The attacker can overwrite the first user account's display name, nickname, and website. The provided information does not indicate that usernames, passwords, email addresses, or account privileges can be changed.
How can exposure be reduced if an update cannot be applied immediately?
Disable or restrict the affected front-end registration form, or remove the display name, nickname, and website fields from that form. This prevents the stated registration path from being used to modify those fields.