{"id":"CVE-2026-42708","published":"2026-10-07T12:17:09.650","lastModified":"2026-10-07T20:17:12.683","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows Blind SQL Injection.This issue affects WP Post Author: from n/a through 4.0.0.","cvssScore":7.6,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/wp-post-author/vulnerability/wordpress-wp-post-author-plugin-4-0-0-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows authenticated attackers to perform blind SQL injection attacks against the WP Post Author plugin, potentially enabling them to extract database information without direct output feedback. The flaw occurs when user input is not properly sanitized before being included in SQL queries.","exploitability":"Exploitation requires an authenticated user account with sufficient privileges (PR:H) and involves crafting specific inputs that trigger blind SQL injection patterns, making it moderately difficult to exploit without prior reconnaissance.","blast_radius":"If exploited, this vulnerability could allow attackers to extract sensitive database information including user credentials, post data, and potentially escalate privileges within the WordPress environment.","remediation":"Upgrade to version 4.0.1 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","wordpress","authenticated"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:01:11.321Z"}}