Live › vulnerability › CVE-2026-108685
The WP Post Author plugin before 4.2.0 does not check whether an account already exists during front-end registration, so it updates the profile of the first user account, normally the administrator. An unauthenticated visitor can overwrite that account's display name, nickname and website when a registration form includes one of those fields.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 06:53 UTC. All times on this page are UTC.
Sites running the WP Post Author plugin before 4.2.0 that accept front-end registration with a form declaring display name, nickname or website fields. The risk is to the first user account, which is normally the administrator. Sites without the plugin, or without a registration form that includes those fields, are not described as exposed.
No product ranges from the sources yet.
4.2.0 are affected.4.2.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end registration, allowing unauthenticated users to overwrite the display name, nickname and website of the first user account, which is normally the administrator, when a registration form declares one of those fields.
This page as .md · .json · in your agent: get_signal("CVE-2026-108685")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.