WP Post Author guest-author tokens permit author-level second-order SQL injection
WP Post Author through 3.9.1 lets an Author store a crafted guest-author token through wpma_metabox_authors_list while creating or editing a post. When an administrator later loads /wp-admin/edit.php, the stored token reaches an insufficiently prepared query and the resulting value is rendered in the Authors column. The two-stage chain can extract sensitive database information. The CNA does not disclose the save handler, query-building function or complete SQL context; despite the CVSS UI:N vector, the published narrative requires the later post-list page load.
- Component
- WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars
- Plugin slug
wp-post-author- Affected
- <= 3.9.1
- Safe version
> 3.9.1- Published
- Aug 05, 2026
This CVE was published Aug 05, 2026 and is one of 7 known issues for this plugin.
Update, patch or deactivate.
Update WP Post Author to a release after 3.9.1. The authoritative record links a trunk correction but does not identify the first fixed release. Review Author-controlled guest-author assignments and avoid loading suspicious post-list entries in a privileged session until updated.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_metabox_authors_list' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step chain: an attacker first saves a crafted guest-author token via the wpma_metabox_authors_list parameter during post creation or editing, then triggers the injection when any admin user loads the post list screen at /wp-admin/edit.php, causing the injected SQL result to be rendered in the Authors column.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N