Vulnerability · Published Oct 29, 2026 · Assigned by WPScan
CVE-2026-108685WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields
Low 3.7
In plain English
A low-severity missing authorization in WP Post Author from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.3%top 82.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP Post Author | 0 – before 4.2.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/605832f7-40d5-4a74-a30a-5f5f2906db63/ exploit, vdb-entry, technical-description