Improper neutralization of special elements in SQL commands allows attackers to inject arbitrary SQL statements into queries executed by the PublishPress Authors plugin for WordPress. This is a classic SQL injection flaw (CWE‑89) that can lead to data exfiltration, modification, or deletion of database contents, potentially compromising confidentiality, integrity, and availability of the site's data.

PublishPress Authors, a WordPress plugin distributed by PublishPress, is affected in all releases up to and including version 4.7.3. The flaw is present in every installation of these versions on any WordPress site, regardless of site configuration or user role.

The CVSS score of 7.6 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that authentication is not explicitly required, so the flaw may be exploitable by unauthenticated or low‑privileged users. The lack of input sanitization enables attackers to execute arbitrary SQL commands, which could compromise the confidentiality, integrity, or availability of the site data.