The vulnerability is an improper neutralization of special elements used in an SQL command, allowing an authenticated attacker to inject arbitrary SQL commands through the wp-post-author plugin. This flaw can lead to unauthorized data disclosure, data tampering, or deletion, impacting the confidentiality, integrity, and availability of database contents. The weakness is characteristic of CWE‑89.

WordPress sites running the wp-post-author plugin version 4.0.0 or earlier are vulnerable. Any site that has not upgraded to version 4.1.0 or later is at risk.

The CVSS score of 7.1 indicates high severity, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is authenticated web traffic targeting the plugin, requiring a valid user account to submit malicious input. If an attacker is able to log in or use an existing account, they can exploit the SQL injection and compromise the database without needing additional privileges.