SQL Injection Vulnerability in WP Post Author Plugin for WordPress
CVE-2026-11977

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
Vendor
CVE Published:
5 August 2026

What is CVE-2026-11977?

The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is susceptible to SQL Injection via the 'wpma_metabox_authors_list' parameter. This vulnerability arises from inadequate escaping of user-supplied input and insufficient preparation of the SQL query. Authenticated users with author-level access can exploit this flaw by injecting additional SQL commands in post creation or editing sessions. When an administrative user subsequently loads the post list screen, the injected SQL executes, potentially revealing sensitive database information.

Affected Version(s)

WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars 0 <= 3.9.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wp-post-author...
https://plugins.trac.wordpress.org/browser/wp-post-author...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ryoma Nishioka
.