Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.5

WordPress Post Author <= 3.9.1 SQL Injection Risk

CVE-2026-57643 · published 4 months ago
Summary

A vulnerability in WordPress Post Author plugin allows attackers to inject malicious SQL code, potentially leading to unauthorized data access or manipulation. Affected users should update to the latest version of the plugin to prevent exploitation. This update is especially important for sites with sensitive user data or public-facing applications.

Original advisory text
Contributor SQL Injection in WP Post Author <= 3.9.1 versions.
Contributor SQL Injection in WP Post Author <= 3.9.1 versions.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published26 Jun 2026
Updated3 Nov 2026
First seen26 Jun 2026
Sources
CVE-2026-57643 · NVD
Track software like this
Free during beta