CVE-2026-108685— WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
Quick assessment
Affected
Unknown WP Post Author
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 4.2.0 版本之前的 WP Post Author WordPress 插件中，存在一个安全漏洞：插件在前端注册过程中更新用户资料时，未验证该账户是否已预先创建。这导致未认证用户可以覆盖第一个用户账户（通常为管理员）的显示名称、昵称和网站字段，前提是注册表单中声明了这些字段之一。
Possible ATT&CK Techniques 2 AI
T1078.004 · Cloud Accounts T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108685
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
Source: CVE Program / CVE List V5
Vulnerability Description
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WP Post Author | 0 ~ 4.2.0 | - |
|
II. Public POCs for CVE-2026-108685
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108685
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-29 · 28 CVEs total
| CVE-2026-115303 | 3.7 LOW | Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Rep |
| CVE-2024-3586 | LetterPress < 2.4.0 - Admin+ Stored XSS | |
| CVE-2026-115282 | Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosur | |
| CVE-2026-115302 | Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion | |
| CVE-2026-115301 | Contact Form by Supsystic < 1.11.1 - Admin+ SSTI via Form Text Block | |
| CVE-2026-115299 | Contact Form by Supsystic < 1.11.1 - Arbitrary Plugin Settings Update via CSRF | |
| CVE-2026-115300 | Contact Form by Supsystic < 1.11.1 - Contact Submission and Statistics Deletion via CSRF | |
| CVE-2026-88928 | PAYCOMET for WooCommerce 5.36 - 5.45 - Unauthenticated Stored Payment Token Overwrite via | |
| CVE-2026-78395 | Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass | |
| CVE-2026-78396 | Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure | |
| CVE-2026-89216 | vTables < 0.3 - Unauthenticated SQL Injection via orderby Parameter | |
| CVE-2026-108763 | Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR | |
| CVE-2026-108686 | WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure | |
| CVE-2026-105258 | LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings | |
| CVE-2026-103693 | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injectio | |
| CVE-2026-110504 | Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization B | |
| CVE-2026-110030 | Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration | |
| CVE-2026-110983 | WP Photo Album Plus < 9.3.04.004 - Photo Comment Deletion via CSRF | |
| CVE-2026-110505 | Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass | |
| CVE-2026-113616 | LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset |
Showing top 20 of 28 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: WP Post Author
-
CVE-2026-108686
WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Ke -
CVE-2026-42708
WordPress WP Post Author plugin <= 4.0.0 - SQL Injection vul -
CVE-2026-57643
WordPress WP Post Author plugin <= 3.9.1 - SQL Injection vul -
CVE-2024-56247
WordPress WP Post Author plugin <= 3.8.2 - SQL Injection vul -
CVE-2024-37101
WordPress WP Post Author plugin <= 3.6.7 - Cross Site Script
Same vendor: Unknown
-
CVE-2026-115303
Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / -
CVE-2026-86794
Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS -
CVE-2026-85007
YT Player < 2.1.4 - Contributor+ Missing Authorization via y -
CVE-2026-114270
GeoDirectory < 2.8.197 - Unauthenticated Password-Protected -
CVE-2026-113617
Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbi