Skip to content
Sign in
3.7 Low

CVE-2026-108685 The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its…

Description

The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.

Affected products and versions

Product Affected versions Fixed in
WP Post Author 4.2 earliest → < 4.2.0 4.2.0

Other CVEs of WP Post Author

The 2 CVEs of WP Post Author →
CVE-2026-108686 The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors,… 3.7 Low
Track this CVE