CVE-2026-108685
CVE-2026-108685 · WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
CVSS 3.7 · Low · EPSS 0.3% · Fix available
- Published
- Updated
Affected products and versions
wp post author
- Versions
- ≥ 0, < 4.2.0: Affected (semver)
Update to 4.2.0