CVE-2026-11977

Name of the Vulnerable Software and Affected Versions WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars versions prior to 3.9.2

Description This issue is a generic SQL Injection, which occurs when an application fails to properly sanitize user input, allowing an attacker to interfere with the queries that an application makes to its database. Authenticated attackers with author-level access or higher can append additional SQL queries to extract sensitive information from the database. The exploitation process involves a two-step chain: first, the attacker saves a crafted guest-author token using the wpma metabox authors list parameter during post creation or editing; second, the injection is triggered when an administrator loads the post list screen at the '/wp-admin/edit.php' endpoint, resulting in the injected SQL output being displayed in the Authors column.

Recommendations Update to a version newer than 3.9.1. Avoid using the wpma metabox authors list parameter during post creation or editing until the update is applied.