Unrated
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created...
CVE-2026-108685
First seen on SecPulse
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| CVE | WP Post Author |
< 4.2.0 |
4.2.0 |
Original description The description as published by the source.
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory
References
- web contact@wpscan.com
- web nvd.nist.gov
- web wpscan.com
- web github.com