CVE-2026-11977 in WP Post Author Plugin
Summary
by MITRE • 08/05/2026
The WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars plugin for WordPress is vulnerable to generic SQL Injection via the 'wpma_metabox_authors_list' parameter in all versions up to, and including, 3.9.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation is a two-step chain: an attacker first saves a crafted guest-author token via the wpma_metabox_authors_list parameter during post creation or editing, then triggers the injection when any admin user loads the post list screen at /wp-admin/edit.php, causing the injected SQL result to be rendered in the Authors column.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability affects the WP Post Author plugin for WordPress, specifically versions up to and including 3.9.1, where a generic SQL injection flaw exists in the 'wpma_metabox_authors_list' parameter handling. The issue stems from insufficient input sanitization and inadequate query preparation mechanisms within the plugin's database operations. The vulnerability operates under CWE-89 which categorizes it as a classic SQL injection attack vector, where user-supplied data is directly incorporated into SQL queries without proper escaping or parameterization. Attackers with author-level privileges or higher can exploit this weakness to manipulate database queries through crafted inputs.
The exploitation mechanism requires a two-phase approach that aligns with ATT&CK technique T1078 for valid accounts and T1566 for credential access. First, an authenticated attacker must create or modify a post while injecting malicious SQL code through the wpma_metabox_authors_list parameter during the guest author creation process. This initial injection is stored in the database within the plugin's metadata structure. The second phase occurs when any administrator or user with sufficient privileges loads the WordPress admin post listing screen at /wp-admin/edit.php, triggering the execution of the malicious SQL code within the Authors column rendering functionality.
The operational impact of this vulnerability extends beyond simple data extraction to potentially allow full database compromise and unauthorized access to sensitive information. Attackers can leverage the SQL injection to retrieve user credentials, administrative tokens, private content, and other confidential data stored in the WordPress database. The vulnerability is particularly dangerous because it requires minimal privileges to exploit, as author-level access is sufficient for successful exploitation. This makes it a significant threat to WordPress installations where multiple users have varying permission levels, especially those with guest author or contributor roles that may not be properly monitored.
Mitigation strategies should focus on immediate plugin updates to versions that address the SQL injection vulnerability, while also implementing proper input validation and parameterized queries throughout the WordPress codebase. Organizations should enforce principle of least privilege access controls, monitor for unusual post creation or modification activities, and consider implementing database query logging to detect potential exploitation attempts. The vulnerability demonstrates the critical importance of proper input sanitization and prepared statement usage in web applications, aligning with security best practices outlined in OWASP Top Ten and NIST cybersecurity guidelines. Additionally, network-based intrusion detection systems should be configured to monitor for SQL injection patterns that may indicate exploitation attempts against WordPress installations.