Improper neutralization of special elements used in an SQL command allows an authenticated user to inject malicious SQL through the WordPress wp‑post‑author plugin. The vulnerability could enable the attacker to read, modify, or delete data stored in the database, potentially compromising the confidentiality, integrity, and availability of the site.

The wp‑post‑author plugin for WordPress, versions prior to 4.1.0, is affected. Any WordPress installation that has this plugin enabled and an attacker can log in with a user account that activates the plugin is at risk.

The CVSS score is 4.9, indicating a medium level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires the attacker to be authenticated, the attack vector is likely an authenticated user sending crafted requests to the plugin. The overall risk is moderate, with a moderate likelihood that an authenticated user could exploit the flaw under normal operating conditions.