CVE-2026-11977: WP Post Author <= 3.9.1 Authenticated SQL Injection

Vulnerability Overview Vulnerability Name: WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection CVE ID: CVE-2026-11977 CVSS Score: 6.5 (Medium) Publication Date: August 4, 2026 Last Updated: August 5, 2026 Researcher: Ryoma Nishioka Affected Software Affected Software: WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars Affected Versions: <= 3.9.1 Fixed Version: 3.10.0 or later Remediation Fix: Upgrade to version 3.10.0 or later Vulnerability Description The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin has a generic SQL injection vulnerability in versions 3.9.1 and earlier. This vulnerability affects all versions via the parameter due to insufficient escaping and sanitization of user-supplied parameters. This allows an authenticated attacker (with author-level access or higher) to append additional SQL queries to extract sensitive information from the database. Exploitation Steps 1. The attacker first saves a guest author token containing a malicious query. 2. During post creation or editing, the malicious query is injected via the parameter. 3. When an administrator loads the post list screen or edits a post, the injected SQL results are rendered in the author column. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: wp-post-author (View on wordpress.org) Patched: Yes Fixed Version: 3.10.0 or later Recent Vulnerabilities WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars - CVE ID: CVE-2026-57543 - CVSS Score: 6.5 - Researcher: hhhai - Date: June 26, 2026 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter - CVE ID: CVE-2024-13362 - CVSS Score: 6.1 - Researcher: Asaf Mozes - Date: April 30, 2026 WP Post Author <= 3.8.2 - Authenticated (Administrator+) SQL Injection - CVE ID: CVE-2024-56247 - CVSS Score: 4.9 - Researcher: NAWardRox - Date: December 30, 2024 Boost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injection - CVE ID: CVE-2024-8757 - CVSS Score: 7.2 - Researcher: Lessor101 - Date: October 11, 2024 WP Post Author <= 3.6.7 - Authenticated (Contributor) Stored Cross-Site Scripting - CVE ID: CVE-2024-37101 - CVSS Score: 6.4 - Researcher: Khalid - Date: June 20, 2024 WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.7.4 - Missing Authorization to Rating Manipulation - CVE ID: CVE-2024-34389 - CVSS Score: 4.3 - Researcher: Kyle Sanchez - Date: June 6, 2024 WP Post Author – Enhance Your Posts with the Author Bio, Co-Authors, Guest Authors, and Post Rating System, including User Registration Form Builder <= 3.6.4 - Missing Authorization to Rating Manipulation - CVE ID: CVE-2024-34387 - CVSS Score: 4.3 - Researcher: Kyle Sanchez - Date: June 6, 2024 WP Post Author <= 3.2.3 - Privilege Escalation - CVE ID: CVE-2024-34386 - CVSS Score: 9.8 - Researcher: Kyle Sanchez - Date: June 28, 2023 Additional Information Copyright: 2012-2026 Defiant Inc. License: Defiant grants a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, publicly communicate, distribute, and sublicense this software vulnerability information. MITRE Corporation: 1999-2026 The MITRE Corporation License: CVE Usage: MITRE grants a perpetual, worldwide, non-exclusive, royalty-free, irrevocable copyright license to copy, prepare derivative works, publicly display, publicly perform, publicly communicate, distribute, and sublicense Common Vulnerabilities and Exposures (CVE) information. Contact Contact Email: wfi-support@wordfence.com Business Hours Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 365 days/year, 1-hour response time Terms of Service Terms of Service: Terms of Service Privacy Policy: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Twitter: Twitter Facebook: Facebook LinkedIn: LinkedIn Instagram: Instagram Products Wordfence Free: Wordfence Free Wordfence Premium: Wordfence Premium Wordfence Care: Wordfence Care Wordfence Response: Wordfence Response Wordfence CLI: Wordfence CLI Wordfence Intelligence: Wordfence Intelligence Wordfence Central: Wordfence Central Support Documentation: Documentation Learning Center: Learning Center Free Support: Free Support Premium Support: Premium Support News Blog: Blog In The News: In The News Vulnerability Advisories: Vulnerability Advisories About About Wordfence: About Wordfence Affiliate Program: Affiliate Program Employment: Employment Contact: Contact Security: Security CVE Request Form: CVE Request Form Stay Updated Subscribe: Sign up for news

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-11977: WP Post Author <= 3.9.1 Authenticated SQL Injection