CVE-2026-42708: WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vulnerability
Published Oct 7, 2026
·Updated
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.
Affected Software
1 affected component
AF themes WP Post Author<=4.0.0
Event History
Oct 7, 2026
CVE Published
via MITRE·11:59 AM
Data Sourced
via MITRE·11:59 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates that an attacker needs high privileges (PR:H). Exploitation is network-accessible and does not require user interaction.
2
What is the potential impact if exploited?
The vulnerability is a blind SQL injection and has high confidentiality impact, meaning an attacker may be able to extract sensitive database information. It also has low availability impact, with no integrity impact indicated by the supplied CVSS vector.
3
Which plugin versions are affected?
WP Post Author versions through 4.0.0 are affected. The available data does not identify a fixed version.