blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2026-108685

LOW 3.7 CVSS 3.1
Published
October 29, 2026
Last modified
October 29, 2026
NVD status
Deferred
Reported by
contact@wpscan.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.

Affected WordPress components

  • WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars Plugin · wp-post-author
    Confirmed match Active
    Before 4.2.0
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Unknown WP Post Author — Before 4.2.0

References

  • wpscan.com https://wpscan.com/vulnerability/605832f7-40d5-4a74-a30a-5f5f2906db63/
  • nvd.nist.gov Official NVD record